CVE-2026-95101

A flaw was found in NGINX. When HTTP/3 is used with proxy request buffering enabled, an unauthenticated remote attacker can inject arbitrary data into proxied requests. This vulnerability allows an attacker to manipulate traffic forwarded to backend servers, compromising data integrity. Mitigatio...

PT-2026-114355

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A flaw exists in the ngx http v3 module module. When HTTP/3 is used in conjunction with the proxy request buffering directive set to on, a...

CVE-2026-77802

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77803

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77803 Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77803

Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021 , contains a front-end request desynchronization vulnerability in the proxy request forwarding component. The root cause is that the software forwards requests containing both Content-Length and Transfer-Encoding ...

EUVD-2026-92426

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77802

Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...

EUVD-2026-92425

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

CVE-2026-77802 HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

PT-2026-105988

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description Front-end request desynchronization is possible in the proxy request forwarding component. When a request contains both Content-Length and...

CVE-2026-77802: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while...

PT-2026-105987

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description HTTP request smuggling is possible in the proxy request forwarding component. This occurs when requests containing multiple Content-Length headers with...

CVE-2026-77803: Inconsistent Interpretation of HTTP Requests

In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present,...

WS-2026-0150

litellm 1.53.1 to 1.94.2: the proxy request-body blocklist rejects vertexcredentials but not its alias vertexaicredentials, so an authenticated user can pass an externalaccount credential that makes the proxy read any local file and send it to an attacker URL GHSA-g5ff-637f-6q2m...

Rocky Linux 9 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54487)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

Rocky Linux 8 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54485)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654485 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message...

Rocky Linux 10.2 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_54486)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202654486 advisory. FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow CVE-2026-64620 FreeRDP: FreeRDP: Double-free vulnerability...

RHEL 9 : freerdp (RHSA-2026:58712)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58712 advisory. FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to...