CVE-2026-19203: Inconsistent Interpretation of HTTP Requests

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3328)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2026-3253)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables a...

PT-2026-87545

Name of the Vulnerable Software and Affected Versions Microsoft Windows Speech affected versions not specified Description An unintended proxy or intermediary issue, known as a confused deputy, allows an authorized attacker to perform local tampering. This occurs when a privileged entity is trick...

PT-2026-96872

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.19.1-tuxcare.3...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3361)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

Fedora 43 : nsd (2026-3ff003d397)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ff003d397 advisory. BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networ...

PT-2026-88161

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled sync ttl greater than zero are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An...

Fedora 44 : nsd (2026-bf1539678e)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bf1539678e advisory. BUG FIXES: Fix for CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Thanks to Qifan Zhang, Palo Alto Networ...

The vulnerability of the freerdp-proxy RDP client component, FreeRDP, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the freerdp-proxy RDP client component, FreeRDP, is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CLSA-2026-1788806634 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.3-tuxcare.2...

CLSA-2026-1788806602 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.2...

CLSA-2026-1788806507 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.2...

CVE-2026-84186

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186

This vulnerability affects PrestaShop and resides in the Tools::getRemoteAddr() function. When the application runs behind a reverse proxy, load balancer, or CDN, it incorrectly trusts the client-supplied X-Forwarded-For header instead of the IP provided by the trusted infrastructure, allowing an...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

EUVD-2026-72305

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

BIT-NODE-MIN-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...