A case-sensitive Transfer-Encoding check in Tinyproxy lets attackers smuggle requests and bypass security controls
An attacker can trigger the flaw with a Transfer-Encoding header that uses a non-lowercase variant such as Chunked. is_chunked_transfer identifies chunked transfer encoding with a case-sensitive comparison, so the proxy frames the message with Content-Length and forwards the original header to the backend. The backend follows the RFC and parses the body as chunked. The request boundaries fall out of sync, which enables HTTP request smuggling and leads to serious consequences including WAF bypass, cache poisoning, and cross-user request hijacking.
Component
Tinyproxy is a lightweight, high-performance HTTP and HTTPS proxy. It is built to give small networks an efficient front reverse proxy or forward proxy. Its core mechanisms forward requests to upstream servers, cache responses, and enforce basic access-control policy, so as to optimize resource scheduling and strengthen network-layer isolation.
Replace the string comparison in the relevant code from strcmp with strcasecmp so matching is case-insensitive. Add a mechanism that resolves CL and TE conflicts according to RFC 7230, and remove the Content-Length header when Transfer-Encoding is present. The header can also be added to the skip list to deepen defense.
CSSA Exclusive Early Warning
9.9 Critical
Missing permission checks in open-mercato SSO configuration management let an attacker obtain super-administrator privileges
An attacker who is an ordinary administrator with the sso.config.manage permission can craft a malicious SSO configuration request that maps any external IdP group to the platform super-administrator role, or links an existing high-privilege account. When the server writes application role mappings and performs automatic email linking, it does not check the privilege of the target role, so the attacker can bypass passwords and multi-factor authentication and directly take over a super-administrator session. A system under the attacker's control faces destruction of data integrity and interruption of service.
Component
open-mercato is a resource-planning system for enterprise user management. Its core architecture uses a RESTful API for multi-function collaboration and multi-role permission configuration, aiming to optimize internal resource scheduling, process automation, and identity-authentication integration.
When creating or updating SSO configuration, add server-side permission checks so the operator cannot grant a role mapping beyond their own privileges. Before automatically linking an account, verify whether the target user is a super administrator, and block the illicit privilege-escalation path.
CVE Intelligence
3
CVE-2026-76964
CVSS
10.0 Critical
2026-11-10
Memory corruption in SAP NetWeaver AS ABAP leads to remote code execution
In SAP NetWeaver Application Server ABAP, an internal component does not sufficiently validate certain network input, an improper validation of a specified input type (CWE-1287). An unauthenticated attacker can send crafted network traffic that triggers a memory-corruption condition in the affected function, threatening system stability and security. SAP NetWeaver AS ABAP has a memory-corruption flaw when handling network requests. An attacker can trigger it with a malicious network packet, leading to remote code execution or full control of the system. Every unpatched SAP NetWeaver Application Server ABAP deployment is affected. The attacker needs no authentication, can attack remotely, requires no user interaction, and can fully control the target system.
Component
SAP NetWeaver Application Server ABAP is an enterprise application-server platform from SAP. It runs enterprise applications written in ABAP and supports complex business-logic processing and network interaction.
Risks
Complete system control: The attacker can run arbitrary code on the victim system and, depending on system privileges, install programs, view, change, or delete data, or create new accounts with full privileges
Unauthenticated attack: The attacker needs no credentials and can trigger the flaw by sending malicious traffic over the network, achieving remote code execution
High-impact damage: Successful exploitation has a high impact on confidentiality, integrity, and availability, and may leak data, tamper with the system, or interrupt service
Monitor logs for abnormal network traffic and memory-access behavior
Enable a strict network access-control list (ACL) for the server environment
Apply the official SAP security patch as soon as possible, or take a temporary mitigation that blocks suspicious network input
CVE-2026-89103
CVSS
10.0 Critical
2026-11-10
A high-privilege default ACL in SAP Gateway leads to unauthorized remote code execution
In SAP Gateway, a default access-control list (ACL) with high privileges is active, so an external attacker is incorrectly classified as an internal application server. This configuration flaw (CWE-863 incorrect authorization) lets any unauthenticated attacker who can reach SAP Gateway over the network perform unauthorized operations in the application environment without authentication. The flaw severely affects the confidentiality, integrity, and availability of affected systems. The attacker can achieve remote code execution or fully control the application environment. Every SAP Gateway instance with this default high-privilege ACL is affected. Network access alone is enough to complete exploitation, with no user interaction, and the attacker can operate the system remotely.
Component
SAP Gateway is part of the SAP solution set. It provides OData services and acts as the communication gateway between clients and backend SAP systems, supporting enterprise application integration and data exchange.
Risks
Unauthorized access: The attacker can reach protected resources without authentication and bypass the security boundary
Complete system control: The attacker can perform arbitrary unauthorized operations in the application environment, which may leak or tamper with data or interrupt service
Attack without user interaction: Direct network access triggers the flaw, with no need to lure a user into clicking or interacting, so the attack is highly stealthy
Immediately review and change the default access-control list (ACL) on SAP Gateway and remove the high-privilege default settings
Apply a strict network access-control policy and limit external access to SAP Gateway
Enable multi-factor authentication and strong authentication so only authorized users can reach critical resources
CVE-2026-107246
CVSS
10.0 Critical
2026-11-10
Path traversal in Plesk Site Import executes arbitrary code as root
Before version 1.13.2 of the Plesk extension Site Import, domain names and session identifiers are not validated correctly, a path-traversal flaw (CWE-22). A non-owner subscription user can redirect a privileged backend session to a directory they control and execute arbitrary code as root. Every Plesk user who has not updated to 1.13.2 is affected. The attacker needs no complex interaction. A non-owner subscription account is enough to trigger the flaw, escalate from a low-privilege user to the highest system privilege (root), and fully control the system.
Component
Plesk is a popular website and server management panel, widely used to simplify website, domain, mail, and database management on Linux and Windows servers.
Risks
From ordinary user to administrator: A non-owner subscription user can use this flaw to bypass privilege limits and obtain root on the server
Complete system control: The attacker can run arbitrary code as root on the victim system and fully control the server, including installing malware, stealing data, or damaging the system
Lateral-movement risk: Once root is obtained, the attacker can further penetrate other systems on the internal network
Upgrade the Plesk Site Import extension to 1.13.2 or later immediately
Review server logs for abnormal path access or session-redirection behavior
Restrict non-administrator access to backend sessions and apply least privilege
Package Poisoning
8
Package Poisoning
npm2026-11-10
focashi@1.1.0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
24de2af1d3255763f124f7a6bb8070c6
Package Poisoning
npm2026-11-10
yonzofficial@2.1.1
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
45345c6d98a896b8b7abfa52daacf21b
Package Poisoning
npm2026-11-10
react-bootstrap-table2-toolkit-bg@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
2f7f411adbc0ed2249b065bb813ffce8
Package Poisoning
npm2026-11-10
template-cards@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
2b166d3cdd0fa68476010237ddc5421e
Package Poisoning
npm2026-11-10
template-projection-map@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
98deaddf03d422e5d7d844ab16ff7cae
Package Poisoning
npm2026-11-10
dowload_ebok_la_historia_universal_en_100_preguntas_by_luis_e_inigo_fernandez_0w097@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
24cbf3891c4be86e536b1d6fc8d45efd
Package Poisoning
npm2026-11-10
moltbook-api-helper@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
f9d7e79aec6ee2638b8cade802a5ea14
Package Poisoning
npm2026-11-10
moltbook-health@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
