PT-2026-67300

Name of the Vulnerable Software and Affected Versions axios versions 0.31.1 through 0.32.x axios versions 1.15.2 through 1.17.x Description In Node.js deployments using the HTTP adapter, a bypass of prototype pollution hardening allows requests to be routed through an attacker-controlled proxy...

PT-2026-61539

Name of the Vulnerable Software and Affected Versions Konnectivity proxy-server affected versions not specified Description A flaw in the configuration of the proxy-server for hosted control planes allows the agent-facing listener to start without the --cluster-ca-cert flag and without token-base...

RHEL 8 : nodejs:22 (RHSA-2026:41947)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:41947 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2026-16242: Missing Authentication for Critical Function

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert and without token-based agent authentication, so client certificates were not validated. A remote attacker who can reach the Konnectivity...

ALSA-2026:41947 Important: nodejs:22 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1954)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1954 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Important: python3.12

Issue Overview: When using the "configparser" module to write configuration files containing multi-line text values with carriage return characters \r the resulting file could be injected with unexpected keys and values if the attacker controls the written value. CVE-2026-0864 When using the...

CVE-2026-63731: Server-Side Request Forgery (SSRF)

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

PT-2026-61697

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumvent request throttling by supplying attacker-controlled X-Real-IP and X-Forwarded-For headers without verification of trusted reverse proxy origin. Attackers...

PT-2026-61694

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to...

PT-2026-67319

Name of the Vulnerable Software and Affected Versions guzzlehttp/guzzle versions prior to 7.14.2 Description The built-in cURL handlers CurlHandler and CurlMultiHandler fail to properly isolate Proxy-Authorization headers from origin servers. This occurs because the handlers place first-class...

CVE-2026-45712: Concurrent Execution using Shared Resource with Improper Synchronization

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy /proxy?data=… maintains a package-level assets mapstringMessageAssets cache, but reads the map without holding assetsMutex while a long-running cleanup goroutine and re-entrant CSS-rewriti...

PT-2026-61690

Name of the Vulnerable Software and Affected Versions HyperDX versions prior to 2.31.0 Description Authenticated team members can perform a server-side request forgery SSRF, which occurs when a server is tricked into making requests to an unintended destination. By providing a caller-controlled...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:42078)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42078 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-1990)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1990 advisory. An attacker controlling an HTTP proxy or performing MITM on the plaintext pre-TLS proxy connection can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2...

RockyLinux 8 : nodejs:22 (RLSA-2026:41947)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

TencentOS Server 3: nginx:1.24 (TSSA-2026:0618)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0618 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

OESA-2026-2985 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

OESA-2026-2984 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though th...

OESA-2026-2988 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPTSTREAMDEPENDS or...