python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

PT-2026-118040

Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

PT-2026-117615

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be...

CVE-2026-112251: URL Redirection to Untrusted Site

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be...

Antoine clawhost input validation vulnerability

Antoine clawhost versions 0.0.45 and earlier have a vulnerability in input validation. This vulnerability stems from an improper handling of the token parameter in the handleRequest function within the Reverse Proxy component. It may lead to open redirection, and remote attackers can exploit this...

PT-2026-115878

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

exactor-waf-guardian

Exactor WAF Guardian !License: MIT/Apache-2.0https://img...

Astra Linux – Vulnerability in Tomcat9

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26, or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers by setting rejectIllegalHeader to false the default for 8.5.x only, Tomcat would not reject requests containing an invalid Content-Length header. This...

Astra Linux – Vulnerability in JRuby

A vulnerability was discovered in Ruby versions 2.5.8, 2.6.x up to 2.6.6, and 2.7.x up to 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, did not rigorously check the transfer-encoding header value. An attacker could potentially exploit this vulnerability to bypass a reverse proxy which...

Astra Linux – vulnerability in Tomcat9

Apache Tomcat versions 10.0.0-M1 through 10.0.6, 9.0.0.M1 through 9.0.46, and 8.5.0 through 8.5.66 failed to properly parse the HTTP transfer-encoding request header under certain conditions, which could potentially lead to request smuggling when used with a reverse proxy. Specifically: - Tomcat...

SUSE CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...

Exploit for CVE-2026-20896

CVE-2026-20896 — Gitea Reverse Proxy Authentication CTF Gitea...

VMware VRealize Network Insight - Remote Code Execution

VMWare Aria Operations for Networks vRealize Network Insight is vulnerable to command injection when accepting user input through the Apache Thrift RPC interface. This vulnerability allows a remote unauthenticated attacker to execute arbitrary commands on the underlying operating system as the ro...

UBUNTU-CVE-2026-88829

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim t...

Gitea 1.26.2 Reverse Proxy Authentication Bypass

Gitea version 1.26.2 Docker images trust reverse proxy authentication headers from any source, allowing unauthenticated impersonation through X-WEBAUTH-USER. This Docker-based proof of concept provides a CTF environment demonstrating access to a private repository...

Linux Distros Unpatched Vulnerability : CVE-2026-88829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the...

CVE-2026-57489

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-57489 FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the...

CVE-2026-57489

Prior to version 3.16.0 , FileRise (a self-hosted web-based file manager) is vulnerable to a full authentication bypass when the AUTH_BYPASS feature is enabled. The root cause is that the application trusts configured reverse-proxy identity headers without validating that the request originated f...