29826 matches found
CVE-2026-21086
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...
CVE-2026-21086
A vulnerability exists in ProxyHandler within systems prior to SMR Aug-2026 Release 1 . Due to improper authorization , a local attacker can gain unauthorized access to the proxy configuration . While the vulnerability's impact is noted as high in certain metrics (CVSS 3.1), no specific exploits ...
CVE-2026-73276
A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...
PT-2026-88963
Name of the Vulnerable Software and Affected Versions FortiPAM Chrome extension affected versions not specified Description An authentication procedure flaw in the Privileged Access Management extension allows remote attackers to compromise the confidentiality and integrity of protected...
ROS-20260909-73-0043
The vulnerability of the Proxy component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
PT-2026-88820
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...
CVE-2026-21086: Improper Input Validation
Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...
Security Advisory 0149
Security Advisory 0149 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-73449 CVSSv3.1 Base Score: 5.9...
The vulnerability of the has_auth() function in the GRANT PROXY component of the MariaDB database management system allows a hacker to bypass existing security mechanisms and increase their privileges.
The vulnerability of the hasauth function in the GRANT PROXY component of the MariaDB database management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass existing security measures and gain increased privileges...
Malicious code in toru-ultimate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
GHSA-CRVJ-82CR-HJCX Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Summary Hono's query parsing does not stop at the URL fragment: a ? appearing after a is treated as the start of a query string. As a result, the application can read request parameters that no other component involved in handling the request can see. Details A fragment is never part of the query...
EUVD-2026-70250
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies...
HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...
GHSA-7MJ9-2MP8-4M2P HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies
Summary httpcore2 does not start TLS for wss:// connections routed through a SOCKS5 proxy. The WebSocket opening handshake and all subsequent frames are sent in plaintext through the proxy path, despite the caller selecting the secure wss scheme. The transport flaw affects httpcore2 releases befo...
CVE-2026-69531
Unintended proxy or intermediary 'confused deputy' in Microsoft Windows Speech allows an authorized attacker to perform tampering locally...
EUVD-2026-72995
Unintended proxy or intermediary 'confused deputy' in Microsoft Windows Speech allows an authorized attacker to perform tampering locally...
EUVD-2026-65228
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured...
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
Summary Current NLTK source reopens SSRF in proxied environments. pathsec.urlopen validates the requested hostname locally, but once proxy inheritance is enabled the real fetch is performed by the proxy rather than by the validated direct-connect socket path. Details - Vulnerability type:...
GHSA-6WW7-3FRV-CQXH NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
Summary Current NLTK source reopens SSRF in proxied environments. pathsec.urlopen validates the requested hostname locally, but once proxy inheritance is enabled the real fetch is performed by the proxy rather than by the validated direct-connect socket path. Details - Vulnerability type:...