CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

CVE-2026-86105 Fireware OS Improper Authorization in Access Portal Reverse Proxy

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

CVE-2026-77756

A flaw was found in Apache Tomcat. This vulnerability, known as HTTP Request/Response Smuggling, occurs when Tomcat processes the transfer-encoding header for an HTTP/1.0 request while operating behind a reverse proxy. A remote attacker could exploit this to cause a denial of service, leading to...

Fedora 45 : perl-Catalyst-Plugin-Static-Simple (2026-4d5a716383)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4d5a716383 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

Fedora 44 : perl-Catalyst-Plugin-Static-Simple (2026-2d96cf2594)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2d96cf2594 advisory. Catalyst::Plugin::Static::Simple for Perl sets the CacheControl header to public for every static asset served. Consequently, intermediaries such as shared...

CVE-2026-100572 OpenClaw before 2026.8.1 Denial of Service via Rate Limit

OpenClaw versions = 2026.3.25 and 2026.8.1 apply invalid-token rate limiting for Synology Chat webhooks before authentication and key the limit on the raw proxy socket address. In deployments where OpenClaw sits behind a trusted reverse proxy or tunnel and multiple external clients share a single...

BIT-OAUTH2-PROXY-2026-76835 OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real reque...

SUSE CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

Linux Distros Unpatched Vulnerability : CVE-2026-77756

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header...

CVE-2026-75886 Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the openshift-session-token cookie. This allows the attacker to send requests to the in-cluster catalogd servic...

9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

Summary 9router treats local loopback requests as trusted and allows access to /v1/ without an API key. In a documented/common reverse-proxy deployment where nginx forwards public traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as local. This allows...

DEBIAN-CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

UBUNTU-CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756 Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756

Apache Tomcat is vulnerable to an HTTP Request/Response Smuggling vulnerability due to the inconsistent interpretation of the transfer-encoding header for HTTP/1.0 requests. When positioned behind a reverse proxy, an attacker can exploit this to cause requests from other users to fail. This issue...

EUVD-2026-85226

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...

CVE-2026-77756

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse prox...