PT-2026-89695

Summary serve/start accepts protocol options in a per-server proxyOpt object. The FTP and S3 RC adapters parse that object and pass it to their server constructors, but the constructors decide whether proxy authentication is enabled by checking the process-global proxy.Opt.AuthProxy instead of th...

PT-2026-89477

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system...

PT-2026-89472

Name of the Vulnerable Software and Affected Versions Traefik versions 1.x Traefik versions prior to 2.11.56 Traefik versions 3.0.0 through 3.7.11 Description Traefik fails to properly handle request headers that act as aliases for other header names. While Go treats headers like...

ALSA-2026:66542 Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

HPESBMU05147 rev.1 - HPE IceWall products, Denial of Service vulnerability

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall Federation Agent 4.0 RHEL7, RHEL8, RHEL9, RHEL10, Windows IceWall Federation Proxy 4.0 RHEL8, RHEL9, RHEL10, Windows CVSS Scores: | CVE | CVSS Vector | Base Score | | -...

PT-2026-89452

Name of the Vulnerable Software and Affected Versions Traefik versions 3.2.0 through 3.7.12 Description Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but fail to inspect req.Trailer. This allows an unauthenticated client to...

CVE-2026-87995 Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 until 0.11.1, src/lib/components/chat/FileNav/PortPreview.svelte rendered terminal port content in an iframe sandbox containing both allow-scripts and allow-same-origin. Because the terminal proxy...

grafana: Grafana: Session takeover via Auth Proxy cache key collision

On instances using Auth Proxy header authentication auth.proxy with identity caching enabled syncttl 0, two distinct user identities could produce the same cache key. An authenticated low-privileged user able to influence their own forwarded identity attributes could be served a higher-privileged...

CLSA-2026-1788960930 rsync: Fix of 5 CVEs

CVE-2026-70459: guard the parentndx consumer against an empty dirflist so a crafted first incremental file list cannot reach an uninitialised heap slot already blocked in els11 by the CVE-2026-53789 transfer-root rejection; added as defence in depth to match upstream's final state -...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 2.0) is affected by an information disclosure vulnerability due to urllib3

Summary urllib3 is used by IBM Cloud Pak for Data System 2.0 as an HTTP client library for Python applications. When HTTP requests are sent without using proxy support, urllib3 versions prior to 1.26.19 and 2.2.2 do not treat the Proxy-Authorization header as sensitive authentication material and...

Exploit for Server-Side Request Forgery in Openclaw

CVE-2026-62201 — OpenClaw Sandbox Exec-Server Network Policy B...

Server-Side Request Forgery (SSRF)

NLTK is vulnerable to a Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the destination when an HTTP proxy is configured, which allows an attacker to provide a validated public URL that the proxy redirects to an internal service, potentially exposing internal...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

A vulnerability exists in ProxyHandler within systems prior to SMR Aug-2026 Release 1 . Due to improper authorization , a local attacker can gain unauthorized access to the proxy configuration . While the vulnerability's impact is noted as high in certain metrics (CVSS 3.1), no specific exploits ...

EUVD-2026-74627

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-21086

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

CVE-2026-21086: Improper Input Validation

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

PT-2026-88820

Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration...

PT-2026-88963

Name of the Vulnerable Software and Affected Versions FortiPAM Chrome extension affected versions not specified Description An authentication procedure flaw in the Privileged Access Management extension allows remote attackers to compromise the confidentiality and integrity of protected...