Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access to critical data due to Java SDK

Summary An exploitable vulnerability in Java allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. IBM Sterling Secure Proxy has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-22016 DESCRIPTION: Easily exploitable vulnerability allo...

CVE-2026-91081

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-73494

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to unauthorized access or information disclosure due to Jetty (CVE-2026-8384)

Summary Eclipse Jetty path traversal/path normalization vulnerability can allow crafted URIs containing semicolon path parameters and .. sequences to bypass path-based authorization checks in applications relying on Jetty's canonicalized paths. IBM Sterling Secure Proxy has addressed the applicab...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to IBM Semeru runtime

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Semeru Runtime and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-34282 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple...

nginx:1.24 security update

An update is available for nginx, module.nginx. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081 Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

EUVD-2026-77716

Docs through 5.6.1 contains a server-side request forgery vulnerability in the cors-proxy endpoint that allows anonymous attackers to make outbound requests by providing a public document UUID. Attackers can exploit DNS time-of-check-time-of-use race conditions and shared address space bypasses t...

CVE-2026-91081

Docs by Suitenumerique (versions through 5.6.1 ) contains a server-side request forgery (SSRF) vulnerability in the cors-proxy endpoint. The root cause involves DNS time-of-check-time-of-use (TOCTOU) race conditions and shared address space bypasses , allowing anonymous attackers to forge outboun...

Moderate: Red Hat Security Advisory: nginx:1.24 security update

An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: IBM webMethods Integration is affected by multiple vulnerabilities

Summary Vulnerabilities have been addressed in IBM webMethods Integration. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the...

Astra Linux – Vulnerability in freerdp3, freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, there was a NULL pointer dereference vulnerability in rdpwritelogoninfov2. This vulnerability allowed a malicious RDP server to crash the FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with...

Astra Linux – Vulnerability in Waitress

In Waitress version 1.4.0, if a proxy server is used in front of Waitress, an attacker may send an invalid request that bypasses the front-end and is parsed differently by Waitress. This could lead to HTTP request smuggling. Specifically, requests containing special whitespace characters in the...

Astra Linux – Vulnerability in Puma

Puma is an HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted; it did not prevent new connections from being blocked by greedy persistent-connections that saturated all threads ...

Astra Linux – Vulnerability in connman

A issue was discovered in the DNS proxy of Connman through version 1.40. The TCP server reply implementation creates an infinite loop if no data is received...

Astra Linux – Vulnerability in connman

A issue was discovered in the DNS proxy of Connman through version 1.40. The forwarddnsreply function improperly handles a strnlen call, resulting in an out-of-bounds read...

Astra Linux – Vulnerability in Tomcat9

There is an input validation vulnerability in Apache Tomcat. Versions of Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81, and from 8.5.0 through 8.5.93 did not properly parse HTTP trailer headers. A specially crafted, invalid trailer header...