CVE-2026-107318

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...

CVE-2026-107318

The @fastify/reply-from Fastify plugin (versions prior to 12.7.0 ) is vulnerable to improper certificate validation in its built-in HTTPS transports. The root cause is that these transports override the secure default by setting rejectUnauthorized to false, causing the proxy to fail to verify the...

CVE-2026-107318 @fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...

EUVD-2026-95261

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...

Security update for libXtst

This update for libXtst fixes the following issue: CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser bsc1281665. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

Security update for libXtst

This update for libXtst fixes the following issue: CVE-2026-94286: out-of-bounds read in libXtst's RECORD reply parser bsc1281665. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

RLSA-2026:75767 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

bind security update

An update is available for bind. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Berkeley Internet Name Domain BIND is an implementation of the Domain Name...

Important: Red Hat Security Advisory: bind security update

An update for bind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

ALSA-2026:75577 Important: bind security update

The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols. BIND includes a DNS server named; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server is operating correctly. Security Fixes:...

CVE-2026-94422 xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve...

toxy

toxy Not actively maintained, may not work with latest node.js runtimes. If you are interested in maintaining toxy, please open an issue. Hackable HTTP proxy to simulate server failure scenarios , systems resiliency testing and unexpected network conditions , built for node.js. It was mainly...

CVE-2026-93228

A flaw was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access RPC-over-RDMA server component svcrdma. A remote peer can exploit this issue by transmitting a malformed Write or Reply chunk with a segment count of zero. Because the kernel fails to validate that the...

CVE-2026-63045

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

PT-2026-103732

The bbp style pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name via /wp-admin/profile.php + bbp reply content via bbPress reply form' parameter in all versions up to, and including, 6.4.8 due to insufficient input sanitization and output escaping. This...

AlmaLinux 9.2 [TuxCare] Security Update: mutt (ALMALINUX9.2:CLSA-2026:1783434809)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783434809 advisory. - In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an...

AlmaLinux 9.6 [TuxCare] Security Update: mutt (ALMALINUX9.6:CLSA-2026:1783436433)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783436433 advisory. - In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an...

AlmaLinux 9.2 [TuxCare] Security Update: iputils / iputils-ninfod (ALMALINUX9.2:CLSA-2025:1753987674)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753987674 advisory. - ping in iputils before 20250602 allows a denial of service application error or incorrect data collection via a crafted ICMP Echo Reply...

Rocky Linux 9.6 [TuxCare] Security Update: mutt (ALMALINUX9.6:CLSA-2026:1783436433)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783436433 advisory. - In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an...

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's 227 reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there...