ai-code-review (>=2.0.0.dev1, <=3.1.2), ai-cr (>=2.0.0.dev1, <=3.1.2) +23 more potentially affected by CVE-2026-32871 via fastmcp (2.8.1)

fastmcp PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ai-code-review =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.2.0, =2.0.0.dev1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source...

beads-mcp (>=0.19.0, <=0.21.5), black-litterman-mcp (>=0.1.0, <=0.3.1) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.13.0.1)

fastmcp PYPI version 2.13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - beads-mcp =0.19.0, =0.1.0, =0.0.67, =0.9.26, =0.1.0, =0.1.1 Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...

LiteLLM has SQL Injection in Proxy API key verification

ImpactA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route for example POST /chat/completions an...

ai-proxy-server (>=3.0.2, <=3.1.0), aiowhitebit-mcp (0.3.0) +48 more potentially affected by CVE-2026-32871 via fastmcp (2.12.5)

fastmcp PYPI version 2.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ai-proxy-server =3.0.2, =1.7.3, =0.1.2.dev0, =1.3.1, =1.0.8, =0.2.0, =0.2.1, =0.1.1, =0.2.12, =0.2.19 and more Source cves: CVE-2026-32871 Source...

biliarchiver (>=0.1.11, <=0.1.20), pv-surrogate-data (>=1.0.0, <=1.0.2) +3 more potentially affected by CVE-2025-58438 via internetarchive (4.1.0)

internetarchive PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - biliarchiver =0.1.11, =1.0.0, =4.3.0, =4.4.2 - wikiteam3-fork-proxy 1.0.0 Source cves: CVE-2025-58438 Source advisory:...

PYSEC-2026-365 TigerVNC accessible via the network and not just via a UNIX socket as intended

Summary jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having...

PYSEC-2026-348 h11 accepts some malformed Chunked-Encoding bodies

Impact A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. Details HTTP/1.1 Chunked-Encoding bodies are formatted as a sequence of "chunks", each of which consists of: - chunk length - \r\n - leng...

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy

A flaw was found in the Go command cmd/go. A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the go command may then download and execute without proper verification...

Exploit for CVE-2025-0133

CVE-2025-0133 Scanner Palo Alto PAN-OS GlobalProtect Reflecte...

CVE-2026-55603

A flaw was found in http-proxy-middleware. A remote attacker could exploit a vulnerability in the fixRequestBody function, which is used to re-emit a request body. By injecting carriage return and line feed characters \r\n into a request body key or value, an attacker can bypass security policies...

BIT-NODE-MIN-2026-48615

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERRPROXYTUNNEL error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability...

BIT-NODE-2026-48615

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in ERRPROXYTUNNEL error messages. When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers. This vulnerability...

BIT-HAPROXY-2026-55203 HAProxy - Integer Overflow in FCGI Demux Record Length Field

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgiconn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record...

BIT-ENVOY-2026-47692 Envoy: PROXY Protocol v2 header generator emits "skipped" TLVs, causing 65 KB attacker-controlled spillover into the upstream application stream

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, PROXY Protocol v2 header generator emits TLVs beyond the maximum length of 65535 bytes, causing a mismatch between bytes written and the length field in th...

BIT-ENVOY-2026-47221 Envoy: Null pointer deref in internal redirects

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 See Other internal redirects for body-less non-GET/HEAD requests...

BIT-APPSMITH-2026-55454 Appsmith: Caddy admin API exposed without authentication

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bundled Caddy reverse-proxy's admin API — which has no authentication by default — is bound on 0.0.0.0:2019 inside the container. While this listener is not directly published to the host by...

CVE-2026-12772

A flaw was found in BerriAI litellm. A remote attacker could exploit a vulnerability in the authenticateuser function within the PROXYADMIN database API Key Generator component. By performing a specific manipulation, an attacker can cause session expiration for users, leading to a denial of servi...

CVE-2026-56285: Server-Side Request Forgery (SSRF)

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including...

PT-2026-53476

Impact A database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route for example POST /chat/completions a...

PT-2026-53646

Summary Alice exposes a Python SDK ProxyShare with a fixed target URL. Bob sends a request to the share with an absolute URL in the path. The Flask handler passes that path to urllib.parse.urljoin, which replaces Alice's configured target host with Bob's host and returns the server-side response ...