CLSA-2026-1788806507 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.2...

CVE-2026-84186

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186

This vulnerability affects PrestaShop and resides in the Tools::getRemoteAddr() function. When the application runs behind a reverse proxy, load balancer, or CDN, it incorrectly trusts the client-supplied X-Forwarded-For header instead of the IP provided by the trusted infrastructure, allowing an...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

EUVD-2026-72305

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

BIT-NODE-MIN-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

BIT-NODE-2026-48932

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-96867

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.2...

CVE-2026-84186: Authentication Bypass by Spoofing

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

Red Hat Quay Proxy Cache Privilege Escalation

The vulnerability of the Proxy Cache component of the Red Hat Quay software platform is related to the improper assignment of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

MariaDB 10.6.0 < 10.6.28/ 10.11.0 < 10.11.19/ 11.4.0 < 11.4.13/ 11.8.0 < 11.8.9/ 12.3.0 < 12.3.3/ 13.0.0 < 13.0.2

The version of MariaDB installed on the remote host is prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. It is, therefore, affected by a vulnerability as referenced in the GHSA-4wgx-ffg9-jrwq advisory. - Impact Incorrect boundary checked made it possible to write one '\0' byte beyond t...

PT-2026-96866

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.2...

PT-2026-96868

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.3-tuxcare.2...

Malicious code in easy-pipe-signal-proxy-uglify (npm)

Source: amazon-inspector cced811f8b7d7d11ae1da05db78dd95c88ffed00ef920a419f7b559ae4c66c77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in easy-interpret-big-proxy-scale (npm)

Source: amazon-inspector 27e1a4cafec6bf1cf5e6e657300eb2f4ec854809b9008a485341088d0b0bc51c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in easy-boolean-mock-proxy-stack (npm)

The package easy-boolean-mock-proxy-stack was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in double-final-proxy-gamma-alpha (npm)

Source: amazon-inspector d4ec39ff7bf59b56c61810df48a1d2af795708d4a5b19120dd66226393f90420 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

goproxy v1.9.1

GoProxy GoProxy is a library to create a customized HTTP/HTTPS proxy server using Go aka Golang, with several configurable settings available. The target of this project is to offer an optimized proxy server, usable with reasonable amount of traffic, yet customizable and programmable. The proxy...

Linux Distros Unpatched Vulnerability : CVE-2026-48932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible...