https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:16:11 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0531 certfr-2026-avi-0531 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0531 https://cve.radiocsirt.org/vuln/cleanstart-2026-mz53124 <p><strong>Affected:</strong> CleanStart: forecastle</p> <p>Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: forecastle</p> <p>Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-mz53124 https://cve.radiocsirt.org/vuln/euvd-2026-319123 EUVD-2026-319123 https://cve.radiocsirt.org/vuln/euvd-2026-319123 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41181 <p>Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik&#39;s errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request&#39;s complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.</p> <p>Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik&#39;s errors (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request&#39;s complete header set, including Authorization, Cookie, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that Host is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the errors middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them. This vulnerability is fixed in 2.11.44, 3.6.15, and 3.7.0-rc.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41181 https://cve.radiocsirt.org/vuln/ghsa-p6hg-qh38-555r <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a medium severity information disclosure vulnerability in Traefik&#39;s `errors` (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request&#39;s complete header set, including `Authorization`, `Cookie`, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that `Host` is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the `errors` middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v2.11.44 - https://github.com/traefik/traefik/releases/tag/v3.6.15 - https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.3</p> <p>## For more information</p> <p>If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>## Description Traefik v3.6.13&#39;s supported HTTP `errors` middleware discloses sensitive request headers to the configured error page service when the original backend response matches the configured status range and the middleware takes its default header-forwarding path. In the r…</p> <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a medium severity information disclosure vulnerability in Traefik&#39;s `errors` (custom error pages) middleware. When the backend returns a response matching the configured status range, the middleware forwards the original request&#39;s complete header set, including `Authorization`, `Cookie`, and other authentication material, to the separate error page service rather than only the minimal context needed to render the error page. This behavior is undocumented: the documentation states only that `Host` is forwarded by default, so operators are not warned that sensitive credentials are shared across service boundaries. Deployments using the `errors` middleware with a distinct error page service may inadvertently expose end-user credentials to infrastructure that was not intended to receive them.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v2.11.44 - https://github.com/traefik/traefik/releases/tag/v3.6.15 - https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.3</p> <p>## For more information</p> <p>If there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>## Description Traefik v3.6.13&#39;s supported HTTP `errors` middleware discloses sensitive request headers to the configured error page service when the original backend response matches the configured status range and the middleware takes its default header-forwarding path. In the r…</p> https://cve.radiocsirt.org/vuln/ghsa-p6hg-qh38-555r https://cve.radiocsirt.org/vuln/opensuse-su-2026:10713-1 <p>traefik-3.6.16-1.1 on GA media</p> <p>traefik-3.6.16-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10713-1