Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

GHSA-M62C-5Q34-F3CF Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

[SECURITY] [DLA 4826-1] puma security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4826-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA October 07, 2026 https://wiki.debian.org/LTS -...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: ntpd-rs, apollo-router, vector, shadowsocks-rust, komodo, sccache, linkerd2-proxy...

GHSA-5J98-2G5X-46V6 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, shadowsocks-rust, sccache, ntpd-rs, vector...

GHSA-6F2X-V7Q7-M7M5 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, shadowsocks-rust, sccache, ntpd-rs, vector...

GHSA-6W6G-HM98-MHGM vulnerabilities

Vulnerabilities for packages: linkerd2-proxy, shadowsocks-rust, sccache, ntpd-rs, vector...

CVE-2026-106243

An incomplete cleanup flaw was found in the Proxy Auth component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/533426590...

CVE-2026-106214

An information leak flaw was found in the Proxy component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/533493992...

curl: curl: Unauthorized access due to improper HTTP proxy connection reuse

A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...

Security Bulletin: Multiple Vulnerabilities in Axios affect IBM Cloud Pak System

Summary Due to the use of Axios, multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config...

SUSE CVE-2026-93315

When proxy networking with CA injection is enabled, a build can modify its CA bundle before cleanup. This may cause cleanup to block, operate outside the build rootfs, or fail without failing the build...

PT-2026-107682

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 3.0.12 AsyncHttpClient versions prior to 2.16.1 Description The library incorrectly infers the existence of an HTTP proxy tunnel based on the last request method instead of the result of the CONNECT request. I...

CVE-2026-107207: Missing Authentication for Critical Function

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...

PT-2026-107565

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...

Debian dla-4826 : puma - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4826 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4826-1 [email protected]...

CVE-2026-107232: Cleartext Transmission of Sensitive Information

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a pro...

CVE-2026-97717: Uncontrolled Resource Consumption

CVE-2026-97717 is a vulnerability in the proxy sub-system of Secure Access servers prior to 14.60. Authenticated attackers can send malformed data to the server and cause a persistent denial of service...