5884 matches found
CVE-2026-42926
A flaw was found in NGINX Open Source. When NGINX is configured to proxy HTTP/2 traffic and uses proxysetbody, a remote attacker may be able to inject malicious data into the upstream peer. This could lead to unintended data manipulation or bypass of security controls. Mitigation To mitigate this...
The vulnerability of the POST /api/v1/repos/{owner}/{repo}/merge-upstream component of the Git repository management system Gitea allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the POST /api/v1/repos/owner/repo/merge-upstream component of the Git repository management system Gitea is related to the lack of protection for service data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...
Fedora 43 : trafficserver (2026-de4e0fac25)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-de4e0fac25 advisory. Update to upstream 10.2.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...
Fedora 44 : trafficserver (2026-b2d993884d)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b2d993884d advisory. Update to upstream 10.2.0. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
cve-2026-47863 - MEDIUM - Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by...
EUVD-2026-62218
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
CVE-2026-11751
The armeria-xds library (versions prior to 1.41.0 ) silently disables TLS peer verification for xDS-managed upstream connections, enabling man-in-the-middle attacks with network-level access. CVSS 4.0 scores this CRITICAL (9.1). Exploitation details are not provided; upgrade to armeria-xds 1.41.0...
CVE-2026-11751: Undefined Security Weakness
A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabled, allowing man-in-the-middle attacks against xDS-managed upstream connections...
PT-2026-78255
Name of the Vulnerable Software and Affected Versions armeria-xds versions prior to 1.41.0 Description An issue exists where xDS upstream TLS peer verification may be silently disabled. This allows man-in-the-middle attacks against upstream connections managed by xDS. TLS Transport Layer Security...
CVE-2026-28753 vulnerabilities
Vulnerabilities for packages: nginx-mainline, nginx-stable...
BIT-GITLAB-2026-16553 Insufficiently Protected Credentials in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in...
CVE-2026-71479: Integer Overflow or Wraparound
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...
PT-2026-73298
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in...
CLEANSTART-2026-WX78037 Security fixes in kubernetes-dns-node-cache 1.26.8-r6
Package kubernetes-dns-node-cache version 1.26.8-r6 fixes 2 vulnerabilities: CVE-2026-50274, ghsa-74j5-xf3v-crq8...
CVE-2026-66381
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2026-66381 Repository readers may access content outside configured upstream paths
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...