CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim prior to 4.100.1 is vulnerable to an out-of-bounds write when Proxy-Protocol is used with an attacker-controlled proxy. The vulnerability is network-reachable with no required privileges but has high attack complexity , yielding a CVSS 3.1 base score of 7.0 (HIGH) with impacts of low confide...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-94054

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CLSA-2026-1789783613 Fix CVE(s): CVE-2026-32853, CVE-2026-32854

SECURITY UPDATE: Heap out-of-bounds read in UltraZip subrect parsing - debian/patches/CVE-2026-32853.patch: bound the subrect cursor to the decompressed data in HandleUltraZipBPP libvncclient/ultra.c - CVE-2026-32853 SECURITY UPDATE: NULL pointer dereference in httpd proxy handlers -...

BIT-RCLONE-2026-88044 rclone: RC per-server auth-proxy bypass

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go...

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CVE-2026-85574

The Unbounce Landing Pages WordPress plugin, in versions before 1.1.5 , is vulnerable to a Reverse-Proxy Target Hijack via the set_unbounce_domains function. The flaw exists because the plugin fails to perform proper authorisation checks when updating the configuration for its front-end proxy. Th...

CVE-2026-85574 Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

EUVD-2026-83503

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

CLSA-2026-1789779650 freerdp: Fix of CVE-2026-67301

CVE-2026-67301: fix client-side out-of-bounds read in the async update message proxy...

CLEANSTART-2026-CU86688 Contour is a Kubernetes ingress controller using Envoy proxy

Security vulnerability affects the external-dns package. Contour is a Kubernetes ingress controller using Envoy proxy...

CVE-2026-94056: Use of Uninitialized Resource

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory...

CVE-2026-94054: Out-of-bounds Write

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write...

CVE-2026-85574: Missing Authorization

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from...

PT-2026-95756

Name of the Vulnerable Software and Affected Versions Unbounce Landing Pages WordPress plugin versions prior to 1.1.5 Description An authorization bypass exists when updating the configuration used by the front-end proxy. This allows any authenticated user, including those with subscriber-level...

PT-2026-95880

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.100.1 Description When Proxy-Protocol is used with an attacker-controlled proxy, the software allows attackers to read certain uninitialized data from stack memory. Recommendations Update to version 4.100.1 or later...