rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone Memory

Summary The shared HTTP CONNECT helper parses a proxy response with http.ReadResponse over an unrestricted buffered reader. The production helper accepted a valid response containing a 2 MiB header in three consecutive runs. A malicious or compromised configured proxy, or an active on-path actor...

CVE-2026-71310

The CVE affects the rclone project before version 1.75.0, where the shared HTTP CONNECT helper in lib/proxy/http.go incorrectly parses proxy CONNECT responses using http.ReadResponse over an unrestricted reader. This unbounded parsing enables a malicious or on-path proxy to send oversized headers...

EUVD-2026-51840

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

Artica Web Proxy 4.30 - OS Command Injection

Artica Web Proxy 4.30 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via servicecmdspeform. id: CVE-2020-17505 info: name: Artica Web Proxy 4.30 - OS Command Injection author: dwisiswant0...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

PT-2026-64428

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists where libsoup incorrectly attaches the Proxy-Authorization header to HTTPS requests sent through a CONNECT tunnel established via an HTTP proxy. This behavior allows the...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

Updated rsync package fixes security vulnerabilities

The updated package fixes security vulnerabilities: Rsync 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write. CVE-2026-29518 Rsync 3.4.3 Authorization Bypass via Hostname Resolution. CVE-2026-43617 Rsync 3.4.3 Integer Overflow Information Disclosure. CVE-2026-43618 Rsync 3.4.3...

CVE-2026-50480

Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...

CVE-2026-49800

Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...

CVE-2026-50480 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

...

CVE-2026-50480

Windows Web Proxy Auto-Discovery Protocol (WPAD) has a heap-based buffer overflow vulnerability (CVE-2026-50480) that can be exploited by an authenticated local attacker to achieve privilege escalation. The issue affects WPAD in Windows, with the root cause described as a heap-based overflow in W...

CVE-2026-49800 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

...

CVE-2026-49800 Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

...

Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...

Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally...

PT-2026-58455

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A heap-based buffer overflow exists in the Windows Web Proxy Auto-Discovery Protocol WPAD. This flaw allows an authorized attacker with local access to elevate their privileges on the system....

PT-2026-58172

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description An integer overflow or wraparound in the Web Proxy Auto-Discovery Protocol WPAD allows an authorized attacker to elevate privileges locally. Recommendations At the moment, there is no...

MAL-2026-10347 Malicious code in nottuff20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45385ab2d7ac9fcd5f37a9faa2824beba492422d1783deef1b9b153eda2e25d2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10307 Malicious code in imillegal2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a225f0551d1cfdc2da755da6241bc992376b5beddd6bc0895ea816391556e985 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...