PT-2026-107245

Name of the Vulnerable Software and Affected Versions Backstage versions 0.5.0 through 0.6.17 Description The @backstage/plugin-proxy-backend package contains inconsistent credential enforcement for overlapping proxy routes. This occurs when an operator configures overlapping proxy paths with...

PT-2026-106764

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules CSM versions prior to 1.18.0 Description The proxy-server component contains an improper certificate validation issue. This allows an unauthenticated adjacent network attacker to potentially expose storage backen...

CVE-2026-67270: Improper Certificate Validation

Dell Container Storage Modules CSM versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially exploit this vulnerability, leading to information exposure of storage backend...

Security Advisory 0196

Security Advisory 0196 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-102164 CVSSv3.1 Base Score: 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSSv4.0 Base Score: 2.3...

CVE-2026-106491: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

PT-2026-107272

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.6.17 Description The @backstage/plugin-proxy-backend package contains improper input validation within the proxy-backend. An authenticated user can craft a request URL that forces the proxy-backend to forward the...

PT-2026-106889

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An information leak exists in the Proxy component of Google Chrome on Windows. This issue allows an adjacent attacker to obtain sensitive information by sending crafted network traffic...

PT-2026-106916

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An issue exists in the Proxy Auth component where incomplete cleanup allows an adjacent attacker to obtain sensitive information by sending crafted network traffic. Recommendations Upda...

PT-2026-107230

Name of the Vulnerable Software and Affected Versions SonicWall SMA1000 versions prior to 12.4.3-03670 SonicWall SMA1000 versions prior to 12.5.0-03082 Description A pre-authentication server-side request forgery SSRF issue exists in the SMA1000 Appliance Work Place interface. This is caused by a...

CVE-2026-106214: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Proxy in Google Chrome on on Windows prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. Chromium security severity: High...

Linux Distros Unpatched Vulnerability : CVE-2026-59783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of availability...

Linux Distros Unpatched Vulnerability : CVE-2026-59786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone with access...

PT-2026-106780

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-stripe versions prior to 3.90.0 @payloadcms/plugin-stripe versions prior to 4.0.0-canary.34 Description An authenticated user can perform unintended Stripe operations by accessing the enabled optional Stripe REST proxy. This...

PT-2026-107150

On affected Arista access points configured with VXLAN tunnelling and L2-proxy a specific configuration unique to the VESPA use-case, a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write...

EUVD-2026-78300

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1691 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: OSV:GHSA-JQCG-44MW-7W3H...

GHSA-JQCG-44MW-7W3H proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Impact proxy-addr determines which network hops are trusted proxies so that X-Forwarded-For can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as ::ffff:10.0.0.0/8 the correct spelling is ::ffff:10.0.0.0/104, the subnet compiles...

@42mo/42mo-web-styles (>=0.0.16, <=0.0.30), @aconex/styleguide (>=2.0.1, <=2.2.0) +1691 more potentially affected by CVE-2026-90711 via proxy-addr (>=1.1.2, <=2.0.7)

proxy-addr NPM version =1.1.2, =0.0.16, =2.0.1, =1.1.0, =0.3.1, =6.1.3, =1.0.0, =1.0.0, =0.0.0, =0.7.15, =0.17.5, =0.17.6-rc.1 and more Source cves: CVE-2026-90711 Source advisory: GHSA-JQCG-44MW-7W3H...

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

NPM: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet vulnerability discovered by ? in WordPress Npm proxy-addr versions = 1.1.0, 2.0.8...

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Impact proxy-addr determines which network hops are trusted proxies so that X-Forwarded-For can be believed. When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix, such as ::ffff:10.0.0.0/8 the correct spelling is ::ffff:10.0.0.0/104, the subnet compiles...