32536 matches found
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the public...
BIT-RCLONE-2026-71310 rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...
BIT-NODE-MIN-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
BIT-PROXYSQL-2026-48772 ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL
ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, the ProxySQL MySQL frontend accepts the PROXY UNKNOWN \r\n PP1 frame as a well-formed PROXY protocol header. The HAProxy PROXY protocol v1 specification says that when the protocol token is UNKNOW...
BIT-NODE-2026-58044
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
BIT-MONGODB-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
CVE-2026-19984
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...
curl: curl: Unauthorized access due to improper HTTP proxy connection reuse
A flaw was found in curl. This vulnerability allows curl to wrongly reuse an existing HTTP proxy connection when performing a CONNECT request to a server, even if the new request uses different authentication credentials for the HTTP proxy. This improper connection reuse could lead to an attacker...
Important: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
curl: Information disclosure due to uncleared proxy authentication state
A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of Proxy-Authorization headers to an incorrec...
Important: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
CVE-2026-19984 jkawamoto mcp-florence2 __init__.py get_images server-side request forgery
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...
CVE-2026-19984
CVE-2026-19984 affects jkawamoto/mcp-florence2 (up to 0.3.13). The vulnerability is in the get_images function of src/mcp_florence2/init .py where the src argument is manipulated, enabling server-side request forgery (SSRF). The issue can be triggered remotely and a PoC exploit has been published...
CVE-2026-19984
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function getimages of the file src/mcpflorence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and...
CVE-2026-74998: Improper Neutralization of Input During Web Page Generation
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS Cascading Style Sheets proxy were not validated, which may result in information disclosure or XSS cross-site scripting via MIME sniffing...
PT-2026-73402
A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...
PT-2026-73431
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, the shared HTTP CONNECT helper in lib/proxy/http.go parses proxy CONNECT responses with http.ReadResponse over an unrestricted buffered reader, allowing a malicious or...
PT-2026-76618
openssl encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation...
phpSysInfo 3.4.5 - IP Allowlist Bypass
Exploit Title: phpSysInfo 3.4.5 - IP Allowlist Bypass Google Dork: N/A Date: 2026-07-11 Exploit Author: Muhammed Mirac Kayikci Vendor Homepage: https://phpsysinfo.github.io/phpsysinfo/ Software Link: https://github.com/phpsysinfo/phpsysinfo/archive/refs/tags/v3.4.5.tar.gz Version: "Client IP...
CVE-2026-59903: Use of Cache Containing Sensitive Information
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...