CVE-2026-58158 Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix th...

CVE-2026-57834

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

CVE-2026-56434

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

bunkerweb v1.6.14-rc1

🌐 Website | 🤝 Panel | 📓 Documentation | 👨‍💻 Demo | 📱 Demo UI | 🧩 Templates | 🛡️ Examples 💬 Chat | 📝 Forum | 📝 Community | 🗺️ Threatmap | 📊 Status | 🔎 Feedback 🛡️ Make security by default great again! BunkerWeb BunkerWeb is a next-generation, open-source Web Application Firewall WAF. Being a...

CVE-2026-58158: Stack-based Buffer Overflow

Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix th...

CVE-2026-66723: Missing Authorization

MWDB Core versions =2.2.0 and 2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the...

CVE-2026-12357: Improper Neutralization of CRLF Sequences

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability. The specif...

PT-2026-65841

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

SUSE SLES12 Security Update : libssh (SUSE-SU-2026:3302-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3302-1 advisory. This update for libssh fixes the following issues - CVE-2026-3731: denial of service via out-of-bounds read in SFTP extension name handler...

SUSE SLED15 / SLES15 Security Update : libssh (SUSE-SU-2026:3330-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3330-1 advisory. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: deni...

TencentOS Server 4: git-lfs (TSSA-2026:0739)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0739 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 4: skopeo (TSSA-2026:0740)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0740 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

NewStart CGSL MAIN 6.06 : glib2 Multiple Vulnerabilities (NS-SA-2026-0061)

The remote NewStart CGSL host, running version MAIN 6.06, has glib2 packages installed that are affected by multiple vulnerabilities: - filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead,...

Linux Distros Unpatched Vulnerability : CVE-2026-58158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through...

cve-2026-59326 - LOW - CVE-2026-59326: HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the httpsproxy / HTTPSPROXY / httpproxy / HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...

PT-2026-65742

Name of the Vulnerable Software and Affected Versions Apache Kyuubi versions 1.8.0 through 1.11.x Description The Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the server t...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the reverse proxy implementation. The proxy forwards the client's Transfer-Encoding header unchanged while forwarding a de-chunked request body, allowing backend request desynchronization and, under certain...

PT-2026-65941

Name of the Vulnerable Software and Affected Versions Heimdall Data Database Proxy affected versions not specified Description Remote authenticated attackers can execute arbitrary code with root privileges on affected installations. The issue stems from insufficient validation of user-supplied...

CVE-2026-23904: Improper Restriction of Communication Channel to Intended Endpoints

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the proxy::proxy and proxy::fullproxy functions. Client-supplied HTTP header values are forwarded to backend servers without validation for control characters, allowing attackers to inject additional HTTP reques...