31442 matches found
CVE-2026-19374: Server-Side Request Forgery (SSRF)
A security vulnerability has been detected in adafap api-mcp up to 92b9a5d04acfec165c7d4ef852496593aa87be06. This affects the function customAxios of the file app/api/proxy/route.ts of the component Proxy API Endpoint. The manipulation of the argument url leads to server-side request forgery. The...
Prototype Pollution
Axios is vulnerable to Prototype Pollution. The vulnerability is due to inherited data, proxy, and paramsSerializer values being read from polluted Object.prototype, allowing attackers to alter request bodies, proxy routing, or URL serialization when affected low-level paths are used...
Prototype Pollution
Axios is vulnerable to Prototype Pollution. The vulnerability is due to Object.prototype.proxy being able to influence the Node HTTP adapter through an un-rehardened request configuration, allowing an attacker who can pollute the prototype to route requests through an attacker-controlled proxy...
MAL-2026-13632 Malicious code in map-streak-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...
EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-3139)
According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithm...
EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-3118)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...
EulerOS 2.0 SP11 : rsync (EulerOS-SA-2026-3100)
According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...
EulerOS 2.0 SP11 : openssh (EulerOS-SA-2026-3085)
According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : OpenSSH before 10.3 can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithm...
EulerOS 2.0 SP11 : curl (EulerOS-SA-2026-3063)
According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the...
EulerOS 2.0 SP11 : rsync (EulerOS-SA-2026-3154)
According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...
OnionHop v3.7.10
OnionHop V3 OnionHop V3 is a modern, cross-platform desktop app Windows, macOS and Linux that routes your traffic through Tor. It can run Tor as a local SOCKS proxy or as a system-wide tunnel, automatically pick a working connection strategy for your network with Smart Connect , scan and apply...
DEBIAN-CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
UBUNTU-CVE-2026-15970
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...
JLSEC-2026-1210 Successfully using libcurl to do a transfer over a specific HTTP proxy (`proxyA`) with **Digest**...
Successfully using libcurl to do a transfer over a specific HTTP proxy proxyA with Digest authentication and then changing the proxy host to a second one proxyB for a second transfer, reusing the same handle, makes libcurl wrongly pass on the Proxy-Authorization: header field meant for proxyA, to...
JLSEC-2026-1216 When reusing a libcurl handle for sequential transfers driven by environment-variable proxy...
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against proxyA using Digest auth, a subsequent transfer routed...
JLSEC-2026-1218 libcurl had a flaw that when instructed to clear proxy authentication credentials which made it...
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them...
JLSEC-2026-1206
curl might erroneously pass on credentials for a first proxy to a second proxy. This can happen when the following conditions are true: 1. curl is setup to use specific different proxies for different URL schemes 2. the first proxy needs credentials 3. the second proxy uses no credentials 4. whil...
CVE-2026-15970
Summary: CVE-2026-15970 affects Consul Community Edition 1.20.1–2.0.2 and Consul Enterprise; an L7 intention authorization bypass occurs when a service proxy uses a custom public listener, allowing an authenticated mesh workload to access HTTP paths blocked by a path-based deny intention. Impact ...
CVE-2026-71849
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header...