CVE-2026-83189: Improper Privilege Management

Vulnerability in the Oracle User Management product of Oracle E-Business Suite component: Proxy User Delegation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User...

CVE-2026-76685: Integer Overflow or Wraparound

A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful...

CVE-2026-11929: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-11927: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-91992: Exposure of Sensitive Information to an Unauthorized Actor

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

CVE-2023-54397: Inconsistent Interpretation of HTTP Requests

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...

PT-2026-92147

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access Reverse Proxy affected versions not specified Description In certain configurations, the software may provide weaker than expected cryptographic validation of user supplied data. Recommendations At the momen...

PT-2026-91873

Name of the Vulnerable Software and Affected Versions proxy-addr versions 1.1.0 through 2.0.7 Description This Node.js module, which determines a request's client address behind trusted reverse proxies and supports Express req.ip and req.ips, contains a flaw where trust subnets written in...

CVE-2026-90711: Authentication Bypass by Spoofing

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...

PT-2026-92712

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.15 Description An issue exists in the Proxy User Delegation component of the Oracle User Management product. A low privileged attacker with network access via HTTP can exploit this flaw to...

CVE-2026-83417: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with access to the physica...

PT-2026-92145

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access affected versions not specified Description The reverse proxy may allow parameters to be injected in requests sent to third party services. Recommendations At the moment, there is no information about a newe...

PT-2026-92445

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A flaw in the proxy packet processing logic occurs when malformed or truncated input is improperly handled. An unauthenticated remote attacker can trigger an...

Linux Distros Unpatched Vulnerability : CVE-2026-90711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions...

CVE-2026-88065: Exposure of Sensitive Information to an Unauthorized Actor

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

PT-2026-97284

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.47 through 9.0.121 Apache Tomcat versions 8.5.67 through 8.5.100 Description An inconsistent interpretation of HTTP...

CVE-2026-83419: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

PT-2026-93125

Name of the Vulnerable Software and Affected Versions tts-be versions prior to 2.1.0 Description Broken Access Control exists across several API endpoints, including '/api/student/id/photo' and '/api/course unit/id/exchange/metadata'. By chaining these unauthenticated endpoints, a remote attacker...

PT-2026-98962

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy...

PT-2026-98422

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of t...