CVE-2026-18394

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394

CVE-2026-18394 affects Strands Agents Tools’ http_request tool prior to v0.8.2, where incorrect authorization could allow an attacker to exfiltrate credentials configured via HTTP_REQUEST_TOKEN_CONFIG by routing requests through proxy infrastructure under attacker control. Root cause: insufficien...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

EUVD-2026-51623

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

SUSE CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Enterprise Webapps

Summary Multiple vulnerabilities were addressed in IBM Aspera Enterprise Webapps version 1.0.5 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router...

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Bitsight says some cheap Android TV boxes have shipped with apps that rewrite their hardware identity to mimic Samsung, Huawei, Xiaomi, or Vivo phones, then click ads on websites run by the same operators. Researchers named the operation Fuyao and attributed it to Zhejiang Fengwo IoT Technology...

Sensitive Information Exposure

datamodel-code-generator is vulnerable to Sensitive Information Exposure. The vulnerability is due to the reuse of Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, which allows an attacker controlling a redirect target to...

oproxy v0.1.10

oproxy oproxy is a local HTTP, HTTPS, and SOCKS5 proxy for inspecting, replaying, and modifying traffic. It is for developers testing browsers, CLIs, mobile apps, API clients, services, and test suites on their own machine or in a local Docker container. Features Capture HTTP traffic and HTTPS...

agent-vault-proxy v0.9.0

keys-on-the-wire Just-in-time API keys for AI agents and any other process you route through it: the caller only ever sees a placeholder. Formerlyagent-vault-proxy. The CLI is now kow; the old avp command still works this release and is removed in the next major ADR-0045. Keys on the Wire protect...

CVE-2026-11771

A flaw was found in OpenVPN. A remote attacker could exploit an off-by-one buffer write vulnerability during NTLM NT LAN Manager proxy authentication. By sending a specially crafted NTLM response from a malicious proxy server, the attacker could cause the OpenVPN client to crash, leading to a...

SUSE CVE-2025-64484

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashe...

SUSE CVE-2025-64513

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the...

Linux br_nd_send() function Heap Buffer Overflow

The vulnerability of the brndsend function in the net/bridge/brarpndproxy.c module of the Linux kernel is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

PT-2026-66844

Name of the Vulnerable Software and Affected Versions Strands Agents Tools versions prior to 0.8.2 Description Incorrect authorization in the http request tool allows remote attackers to obtain credentials configured via HTTP REQUEST TOKEN CONFIG. This occurs when an attacker influences the Large...

How to Prevent Veeam Reverse Proxy Service From Locking Port 80

Purpose The Veeam Reverse Proxy Service, a component of Veeam Backup & Replication, binds to port 80 by default in order to redirect HTTP requests to HTTPS on port 443. This article explains how to disable HTTPS redirection so that the service listens only on port 443, allowing port 80 to be clos...

CVE-2026-18394: Incorrect Authorization

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

PT-2026-66676

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.4 Description The IncomingRequest::isSecure function trusts the X-Forwarded-Proto and Front-End-Https headers from any incoming request. This allows an attacker to spoof these headers, leading the application ...

CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...

ALPINE-CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server...