LiteLLM Proxy has server-side request forgery via the `user_config` request parameter

Summary A server-side request forgery in LiteLLM Proxy lets an authenticated caller redirect the proxy's outbound request to a host of their choosing by smuggling an apibase inside the userconfig request body, bypassing the existing parameter guard. Details LiteLLM Proxy validates request bodies...

CVE-2026-92983 InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated attackers can send completion requests to the proxy endpoint that accumulate...

OPENSUSE-SU-2026:21872-1 Security update for memcached

This update for memcached fixes the following issue: - heap buffer overflows in default-config LRU-crawler metadump and proxy backend-response length truncation bsc1270716...

RHLW-2026-666A4E7D1066F856 Lightwell Security Advisory: logback-core 1.5.16.rhlw-00002

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.16.rhlw-00002 with a backported security fix. CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.16 from Maven Central...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-50734, CVE-2026-53917, CVE-2026-10050, CVE-2026-10051, CVE-2026-6790 affect IBM Sterling Secure Proxy and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-50734 DESCRIPTION: Memory Allocation with Excessive Size Value vulnerability i...

Malicious code in kk-proxy (npm)

The package kk-proxy was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kernel-abstract-compile-proxy-orchestrate (npm)

The package kernel-abstract-compile-proxy-orchestrate was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in kernel-promise-proxy-xml-pipe (npm)

Source: amazon-inspector dbcf722d296a805c892de52ff3cd2ad37ac131c515bfb952e27dae7d017d108d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Rclone 1.64.x < 1.75.1 FTP Auth-Proxy Cross-Session Backend Confusion (CVE-2026-88017)

The version of Rclone installed on the remote host is 1.64.x prior to 1.75.1. It is, therefore, affected by a cross-session backend confusion vulnerability: - The FTP auth-proxy driver stores one obscured password per username in a server-wide map and does not bind the credential or the returned...

CVE-2026-69399: Unintended Proxy or Intermediary

Azure Arc Elevation of Privilege Vulnerability...

CVE-2026-54907: Initialization of a Resource with an Insecure Default

Caddy Proxy Manager is a web interface for managing Caddy Server reverse proxies and certificates. Prior to 1.5.1, Caddy Proxy Manager enables email and password self-registration by default at /api/auth/sign-up/email, allowing an unauthenticated remote actor to create an active account with the...

CVE-2026-90106: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address...

PT-2026-94356

Name of the Vulnerable Software and Affected Versions InternLM LMDeploy versions prior to 0.17.1 Description In DistServe prefill/decode disaggregation mode, the proxy uses user-facing session IDs instead of internal scheduler keys, which prevents the release of scheduler sessions. Unauthenticate...

PT-2026-94395

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.0.0 through 2.16.0 AsyncHttpClient versions 3.0.0 through 3.0.11 Description When using an HTTP proxy to reach an HTTPS origin, the library may expose preemptive origin credentials. This occurs because...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-109805)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109805 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. Tenable has extracted the preceding description block directly from the Unity Linux securi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-109824)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-109824 advisory. FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled e.g. xfreerdp...

PT-2026-94454

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bridge network component regarding the ARP/ND proxy. The system reads the neighbor hardware address directly, which can lead to torn or partial reads if the neighb...

PT-2026-94385

Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions 2.1.0 through 2.16.0 AsyncHttpClient versions 3.0.1 through 3.0.11 Description Requests using an authenticated SOCKS proxy can expose proxy credentials to the origin server. This occurs because NettyRequestFactory and...

CVE-2026-85719: Cleartext Transmission of Sensitive Information

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 and 3.0.12, requests using an authenticated SOCKS proxy can expose the proxy's credentials to the origin because NettyRequestFactory and...

PT-2026-95105

Name of the Vulnerable Software and Affected Versions Caddy Proxy Manager versions prior to 1.5.1 Description Caddy Proxy Manager allows unauthenticated remote actors to create active accounts with the user role without administrator approval. This occurs because email and password...