29833 matches found
CVE-2026-43871 vulnerabilities
Vulnerabilities for packages: temporal, nri-cassandra, telegraf, wavefront-proxy, minio, bento, nri-jmx, seaweedfs, tempo, zipkin, jaeger, amazon-cloudwatch-agent, jitsucom-bulker, grafana, nri-kafka, datadog-agent...
GHSA-8WV5-X4W7-5GWW vulnerabilities
Vulnerabilities for packages: temporal, nri-cassandra, telegraf, wavefront-proxy, minio, bento, nri-jmx, seaweedfs, tempo, zipkin, jaeger, amazon-cloudwatch-agent, jitsucom-bulker, grafana, nri-kafka, datadog-agent...
CVE-2026-73812
A flaw was found in the inets httpd server, part of Erlang/OTP. The server incorrectly processes HTTP requests that contain both Transfer-Encoding: chunked and Content-Length headers, failing to reject them or close the connection as required by RFC 9112 §6.1. When inets is deployed behind a...
CVE-2026-84394
fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...
CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 are affected by an information disclosure vulnerability in the Save Session Info PDU writers within libfreerdp/core/info.c. Three functions (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Ze...
SUSE CVE-2026-48932
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
PT-2026-85126
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' CWE-444 in Elasticsearch can lead to information disclosure via HTTP Request Smuggling CAPEC-33. Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other...
PT-2026-85045
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...
Linux Distros Unpatched Vulnerability : CVE-2026-84324
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network...
CVE-2026-85089: Use of Uninitialized Resource
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089: Use of Uninitialized Resource
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
RHEL 10 : golang-github-openprinting-ipp-usb (RHSA-2026:62631)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:62631 advisory. HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-U...
PT-2026-84985
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...
CVE-2026-85124: Improper Limitation of a Pathname to a Restricted Directory
@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from...
The vulnerability of the intermediate software, StripPrefix of the Containous Traefik reverse proxy server, allows attackers to bypass security restrictions and gain unauthorized access to protected information.
The vulnerability of the intermediate software program StripPrefix of the Containous Traefik reverse proxy server relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain...
Microsoft Edge (Chromium) < 152.0.4191.62 Multiple Vulnerabilities
The version of Microsoft Edge installed on the remote Windows host is prior to 152.0.4191.62. It is, therefore, affected by multiple vulnerabilities as referenced in the September 8, 2026 advisory. - Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute...
Roundcube Webmail 1.6.x < 1.6.18 / 1.7.x < 1.7.3 Multiple Vulnerabilities
The remote web server is running Roundcube Webmail version 1.6.x prior to 1.6.18 or 1.7.x prior to 1.7.3. It is, therefore, affected by multiple vulnerabilities: - The cmdlearn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This iss...
GHSA-9468-V6MJ-FPPW Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Vulnerability Details File: internal/client/handler.go OnClientConnecting, internal/proxy/http.go requestHeaders, internal/proxy/grpc.go requestMetadata, internal/unigrpc/grpc.go Consume Line: handler.go:389,548-552 e.Headers - SetEmulatedHeadersToContext, http.go:131-165 requestHeaders,...
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends
Vulnerability Details File: internal/client/handler.go OnClientConnecting, internal/proxy/http.go requestHeaders, internal/proxy/grpc.go requestMetadata, internal/unigrpc/grpc.go Consume Line: handler.go:389,548-552 e.Headers - SetEmulatedHeadersToContext, http.go:131-165 requestHeaders,...
