AlmaLinux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776763910)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776763910 advisory. - A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF Carriage Return Line Feed Injection, occurs...

Rocky Linux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1779788314)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779788314 advisory. - CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 Note that Nessus has not tested for this issue b...

Rocky Linux 9 [CIQ] Security Update: python3.12-urllib3 (crlsa-2024_9457)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20249457 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1742924802)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1742924802 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / numpy-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7034)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237034 advisory. python: tarfile module directory traversal CVE-2007-4559 python-requests: Unintended leak of Proxy-Authorization header CVE-2023-32681 Tenable has extracte...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1790248981)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790248981 advisory. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. T...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

CLEANSTART-2026-QD51578 Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

Security vulnerability affects the buildkitd package. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

CLEANSTART-2024-JE78408 issue was discovered in the DNS proxy in Connman through 1

Security vulnerability affects the connman package. An issue was discovered in the DNS proxy in Connman through 1...

CLEANSTART-2024-TX08418 issue was discovered in the DNS proxy in Connman through 1

Security vulnerability affects the connman package. An issue was discovered in the DNS proxy in Connman through 1...

CLEANSTART-2024-HH25649 issue was discovered in the DNS proxy in Connman through 1

Security vulnerability affects the connman package. An issue was discovered in the DNS proxy in Connman through 1...

CVE-2026-101899

Axios supports proxy environment variables and evaluates "NOPROXY" exclusions in the Node.js adapter. CIDR-form "NOPROXY" entries such as "127.0.0.0/8", "10.0.0.0/8", or "169.254.169.254/32" are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusi...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

NPM: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

NPM: Axios: CIDR-form NOPROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

GHSA-44G4-M2MJ-WPVX Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

Improper Isolation or Compartmentalization

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for...

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

NPM: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.20.0...

Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

Summary Axios for Node.js does not apply configured DNS lookup or proxy controls when a request uses httpVersion: 2. The HTTP/1 adapter path wraps and forwards config.lookup, builds normal request options, and applies proxy routing through setProxy. The HTTP/2 path builds a session with...