PT-2026-82509

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

PT-2026-82564

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcp target parameter and proxied to it without inspecting the...

CVE-2026-26899

The luci-app-https-dns-proxy component in OpenWrt PR #15 (prior to 2026-01-17) is vulnerable to arbitrary command execution. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to properly neutralize shell metacharacters in the name parameter, allowing authenticated users t...

TencentOS Server 3: freerdp (TSSA-2026:0918)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0918 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 3: nghttp2 (TSSA-2026:0905)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0905 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:3798-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3798-1 advisory. - CVE-2026-5545: wrong reuse of HTTP Negotiate connection bsc1262632. - CVE-2026-5773: wrong reuse of SMB...

PT-2026-82579

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0 Description An issue exists in the isSSRFSafeURL function where it fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

clickhouse-datasource silently drops TLS over PDC

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82517

Name of the Vulnerable Software and Affected Versions luci-app-https-dns-proxy versions prior to 2026-01-17 Description Authenticated users can execute arbitrary shell commands due to improper handling of shell metacharacters in the name parameter within the setInitAction function located in...

curl: 43: HTTP proxy CONNECT header chooses the `-OJ` filename after a redirect

Summary When curl follows an HTTPS redirect through an HTTP CONNECT proxy, a stale response code lets the proxy's CONNECT response Content-Disposition header control the local output filename. With --location --remote-name --remote-header-name, the proxy-provided filename is used for the...

FBI Disrupts Chinese Proxy Tools Used in Mass Hacking of US Agencies and Infrastructure

China’s hacking campaign targeted NASA, the Federal Reserve, the US Senate, the Justice Department, and more, according to the DOJ...

CVE-2026-79126

A flaw was found in Proxy in Google Chrome. An adjacent attacker could exploit this vulnerability by sending crafted network traffic, potentially leading to the disclosure of sensitive information. This issue stems from an incorrect provision of specified functionality within the Proxy component...

SUSE-SU-2026:23361-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...

SUSE-SU-2026:23350-1 Security update for curl

This update for curl fixes the following issues: - CVE-2026-5773: wrong reuse of SMB connection bsc1262633. - CVE-2026-7168: cross-proxy Digest auth state leak bsc1263440. - CVE-2026-8926: password leak with netrc and user in URL bsc1268412. Changes for curl: - Call httpsize first to prioritize...

CVE-2026-19538

A flaw was found in nsd. A remote attacker can bypass BLOCKED access control list ACL items on the proxy protocol port. This bypass occurs when connecting over TCP or TLS and sending the query twice on a persistent connection. This could allow unauthorized access or actions that should have been...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...