MAL-2026-16181 Malicious code in strapi-plugin-plsresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...

Malicious code in strapi-plugin-ccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-she...

MAL-2026-16180 Malicious code in strapi-plugin-ccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-she...

PT-2026-92145

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access affected versions not specified Description The reverse proxy may allow parameters to be injected in requests sent to third party services. Recommendations At the moment, there is no information about a newe...

PT-2026-92147

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access Reverse Proxy affected versions not specified Description In certain configurations, the software may provide weaker than expected cryptographic validation of user supplied data. Recommendations At the momen...

PT-2026-97284

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.25 Apache Tomcat versions 10.1.0-M1 through 10.1.59 Apache Tomcat versions 9.0.47 through 9.0.121 Apache Tomcat versions 8.5.67 through 8.5.100 Description An inconsistent interpretation of HTTP...

CVE-2026-11929: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-11927: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

SaadStrike

💀 SaadStrike ███████╗ █████╗ █████╗ ██████╗ ███████...

CVE-2026-65838 Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because...

Framework

🔒 Pentest Framework !Pythonhttps://img.shields.io/badge/Py...

Astra Linux – Vulnerability in Puma

Puma is an HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted; it did not prevent new connections from being blocked by greedy persistent-connections that saturated all threads ...

Astra Linux – Vulnerability in Tomcat9

Apache Tomcat versions 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46, and 8.5.0 to 8.5.66 failed to properly parse the HTTP transfer-encoding request header under certain circumstances, which could lead to requests for data smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: xfrm: fixed the race condition in ipRtbug for icmpRouteLookup reverse path icmpRouteLookup performs multiple route lookups to find a suitable route for sending ICMP error messages, with special handling for XFRM IPsec policies. T...

Astra Linux – Vulnerability in Tomcat9

There is an input validation vulnerability in Apache Tomcat. Versions of Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81, and from 8.5.0 through 8.5.93 did not properly parse HTTP trailer headers. A specially crafted, invalid trailer header...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to improper input validation in Apache Tomcat. In versions of Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82, and from 8.5.0 through 8.5.95, HTTP trailer headers were not parsed correctly. A trailer header th...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fixed the incorrect order of resource deallocation. When attempting to destroy a QP or CQ, we first reduce the reference count and potentially free the memory regions allocated for the object. Then, we request the devic...

the-few-chosen-ctf-2026

The Few Chosen CTF 2026 — Writeups Solutions, exploits, and w...

pingap v0.14.2

pingap Overview Pingap is a high-performance reverse proxy powered by the Cloudflare Pingora . It simplifies operational management by enabling dynamic, zero-downtime configuration hot-reloading through concise TOML files and an intuitive web admin interface. Its core strength lies in a powerful...

EUVD-2026-76744

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...