CVE-2026-17107: Unintended Proxy or Intermediary

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes RHACM and multicluster-engine MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke...

CVE-2026-66339: Insertion of Sensitive Information Into Sent Data

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-66339: Insertion of Sensitive Information Into Sent Data

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

PT-2026-64428

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists where libsoup incorrectly attaches the Proxy-Authorization header to HTTPS requests sent through a CONNECT tunnel established via an HTTP proxy. This behavior allows the...

CVE-2026-42933

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

CVE-2026-42933

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

CVE-2026-42933 Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

CVE-2026-42933 Unintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation...

CVE-2026-42933

The CVE-2026-42933 affects Pronetiqs IntraVUE up to version 3.2.1a14, where an unintended proxy/intermediary could let an attacker act as an active proxy, bypassing OT segmentation. According to the connected records, this is a network‑level vulnerability with high/critical impact (CVE-2026-42933...

Updated apache packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...

CVE-2026-48535

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535 GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

EUVD-2026-48294

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535 GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected paylo...

CVE-2026-48535

GFI Archiver Additional Settings page. Exploitation requires authenticated access; CVSS 4.0/3.1 base scores are 5.1 (medium) and 5.4 (medium) respectively. Remediation: upgrade to version 15.13 or later. If upgrading is not possible, apply the documented workaround as per vendor guidance.

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of service...

SUSE-SU-2026:3207-1 Security update for python-aiohttp

This update for python-aiohttp fixes the following issues - CVE-2026-22815: insufficient restrictions in header/trailer handling can cause uncapped memory usage and a denial of service bsc1261320. - CVE-2026-34513: unbounded DNS cache can cause a excessive memory usage and lead to a denial of...

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

ImpactLiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In...

LiteLLM: Arbitrary file write via path traversal in Skills archive extraction

ImpactLiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...