kernel: rtmutex: Use waiter::task instead of current in remove_waiter()

A flaw was found in the Linux kernel. When the kernel's real-time mutex rtmutex component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' UAF vulnerability, where the system attempts to use...

CVE-2026-77756

A flaw was found in Apache Tomcat. This vulnerability, known as HTTP Request/Response Smuggling, occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request while operating behind a reverse proxy. A remote attacker could exploit this to cause a denial of service, leading to...

CLEANSTART-2026-CT50806 proxy-addr is a Node

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

EUVD-2026-88568

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

EUVD-2026-88567

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

PT-2026-102666

Name of the Vulnerable Software and Affected Versions urllib3 versions 1.26.0 through 2.7.x Description Target-server TLS settings are incorrectly applied to the HTTPS proxy connection, causing configuration paths to fail to remain separated. This occurs when an application uses an HTTPS proxy an...

CVE-2026-97687: Improper Certificate Validation

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

PT-2026-109069

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

PT-2026-109073

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

PT-2026-109075

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

PT-2026-109113

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

PT-2026-109072

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy ssl context, proxy assert hostname, proxy assert fingerprint, ssl context, cert reqs, verify mode, use forwarding for https=True, and CERT NONE configuration paths fail to remain separated because target-server TLS...

PT-2026-102952

Name of the Vulnerable Software and Affected Versions Fireware OS affected versions not specified Description An improper authorization issue exists in the Access Portal reverse proxy. This allows an authenticated user with low privileges to access unauthorized web applications by sending a...

PT-2026-102885

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

PT-2026-108377

Security vulnerability affects the argo-workflows package. proxy-addr is a Node...

CVE-2026-79538: Improper Control of Generation of Code

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79538

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio createTransport, STDIO branch, routers/mcp-proxy/server.ts...

CVE-2026-79538

The metatool-ai MetaMCP software, specifically version 2.4.22 and below, is vulnerable to Code Execution . This vulnerability exists in the internal MCP inspector proxy endpoint at GET /mcp-proxy/server/stdio. The root cause is located within the createTransport function in the STDIO branch , spe...

Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : Exim vulnerabilities (USN-8834-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8834-1 advisory. It was discovered that Exim had an out-of-bounds write when Proxy-Protocol was used with an attacker- controlled proxy. A remote...