SUSE SLES15 Security Update : nginx (SUSE-SU-2026:3448-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3448-1 advisory. - CVE-2026-42055: heap buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules bsc1268492. - CVE-2026-42533: heap...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

Important: python3

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

The vulnerability of the http_proxy_connect() function in the RDP client FreeRDP allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the httpproxyconnect function in the RDP client FreeRDP is related to the lack of handling for CRLF sequences in HTTP headers when processing the variable ServerHostname. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

CVE-2026-18667

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-18667 Sensor Proxy Version 1.4.2 Fixes One Vulnerability

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-18667

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-18667

Affected product: Tenable Sensor Proxy; version: 1.4.2 (the release fixes a vulnerability). Vulnerability and impact: A remote attacker can cause code to execute with elevated privileges by persuading an operator to connect the sensor to an attacker-controlled host. The CVSS metrics indicate high...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-48061

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

UBUNTU-CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

GHSA-V5MV-P594-2X33 Guzzle: Noncanonical host can bypass host-based checks

Impact In affected versions, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same through fopen. libcurl then parses the...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-69246

CVE-2026-69246 affects the PHP HTTP client Guzzle. Before versions 7.15.2 and 8.0.1, Guzzle passes the request URI to the transport as text and separately provides a Host header. The cURL handlers set CURLOPT_URL to the URI as written and push the Host into CURLOPT_HTTPHEADER; StreamHandler does ...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-48061

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

SUSE CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If...

axios: axios: NO_PROXY bypass allows exposure of local services

A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NOPROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This...

CVE-2026-67315

A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NOPROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This...