Malicious code in shift-v4-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81 [email protected] is a typosquat of the scoped package @shiftforex/shift-sdk-v4 self-identified as such in a comment inside dist/index.js. Its...

MAL-2026-12315 Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

MAL-2026-12349 Malicious code in chai-assertions-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...

MAL-2026-12106 Malicious code in @wethenorth12/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f54c89c6e669f4a9e1e2939e09b5ac809507f98df451e239add607d417f394a Package name mimics MetaMask's official web3-provider-engine and its README advertises a drop-in replacement, but the exported API...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

CVE-2026-9190: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

PT-2026-68218

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An HTTP request smuggling issue exists in the HTTP App Server. This occurs when a crafted HTTP request containing both...

Inconsistent Interpretation of HTTP Requests at org.eclipse.jetty:jetty-http dependency in Crucible Server

This is a vulnerability in a non-Atlassian Crucible Server dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Inconsistent Interpretation of HTTP Requests vulnerability was introduced in version 4.9.0 of Crucible Server. Thi...

Important: Red Hat Security Advisory: Satellite 6.19.3 Async Update

A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-15314: Buffer Copy without Checking Size of Input

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

RHEL 9 : Satellite 6.19.3 Async Update (Important) (RHSA-2026:50221)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50221 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket upgrade. An attacker can bypass request boundaries and interfere with HTTP request processing by crafting specially constructed HTTP requests. Remediation Upgrade aiohttp to version 3.14.2 or...

CVE-2026-69243 AIOHTTP: HTTP request smuggling via WebSocket upgrade

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

PT-2026-76194

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

EUVD-2026-51623

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394

CVE-2026-18394 affects Strands Agents Tools’ http_request tool prior to v0.8.2, where incorrect authorization could allow an attacker to exfiltrate credentials configured via HTTP_REQUEST_TOKEN_CONFIG by routing requests through proxy infrastructure under attacker control. Root cause: insufficien...