AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.6:CLSA-2026:1779788314)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779788314 advisory. - CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 Note that Nessus has not tested for this issue but...

Rocky Linux 8 [CIQ] Security Update: python3.12-urllib3 (crlsa-2024_8842)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20248842 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

Rocky Linux 8 [CIQ] Security Update: python3.11-urllib3 (crlsa-2024_8843)

The Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20248843 advisory. urllib3: proxy-authorization request header is not stripped during cross-origin redirects CVE-2024-37891 Tenable has extracted the preceding description block...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1789729116)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789729116 advisory. - A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with ...

Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux (ALMALINUX9.6:CLSA-2026:1790248981)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790248981 advisory. - Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled syncttl greater than zero are affected. T...

PT-2026-103934

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.69 Description Improper validation of the FTP PASV reply address in the mod proxy ftp module allows an untrusted FTP server to force the proxy to open a data connection to an arbitrary third-party host...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

WS-2026-0150

litellm 1.53.1 to 1.94.2: the proxy request-body blocklist rejects vertexcredentials but not its alias vertexaicredentials, so an authenticated user can pass an externalaccount credential that makes the proxy read any local file and send it to an attacker URL GHSA-g5ff-637f-6q2m...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

CLEANSTART-2026-QD51578 Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

Security vulnerability affects the buildkitd package. Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

CLEANSTART-2024-JE78408 issue was discovered in the DNS proxy in Connman through 1

Security vulnerability affects the connman package. An issue was discovered in the DNS proxy in Connman through 1...

CLEANSTART-2024-TX08418 issue was discovered in the DNS proxy in Connman through 1

Security vulnerability affects the connman package. An issue was discovered in the DNS proxy in Connman through 1...

CLEANSTART-2024-HH25649 issue was discovered in the DNS proxy in Connman through 1

Security vulnerability affects the connman package. An issue was discovered in the DNS proxy in Connman through 1...

CVE-2026-101899

Axios supports proxy environment variables and evaluates "NOPROXY" exclusions in the Node.js adapter. CIDR-form "NOPROXY" entries such as "127.0.0.0/8", "10.0.0.0/8", or "169.254.169.254/32" are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusi...

Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...

NPM: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

NPM: Axios: CIDR-form NOPROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges vulnerability discovered by ? in WordPress Npm axios versions = 1.15.0, 1.20.0...

GHSA-44G4-M2MJ-WPVX Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...

Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

Summary Axios supports proxy environment variables and evaluates NOPROXY exclusions in the Node.js adapter. CIDR-form NOPROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion...