CLSA-2026-1783991046 TuxCare security update for http-proxy-middleware (3 CVEs)

TuxCare rebuilt http-proxy-middleware to address 3 CVEs. Fixed in 3.0.3-tuxcare.1...

CLSA-2026-1774657386 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.19.1-tuxcare.1...

agent-vault v0.39.1

HTTP credential proxy and vault An open-source credential broker by Infisical that sits between your agents and the APIs they call. Agents should not possess credentials. Agent Vault eliminates credential exfiltration risk with brokered access. New here? Thelaunch blog post has the full story...

PT-2026-75453

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.2-tuxcare.1...

PT-2026-75448

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.17.3-tuxcare.1...

PT-2026-74174

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 2.0.8-tuxcare.1...

PT-2026-75488

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 2.0.7-tuxcare.3...

PT-2026-74460

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.1...

PT-2026-75395

TuxCare rebuilt http-proxy-middleware to address 3 CVEs. Fixed in 3.0.3-tuxcare.1...

PT-2026-75423

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 2.0.7-tuxcare.1...

PT-2026-74175

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.19.1-tuxcare.1...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1998)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1998 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated...

PT-2026-75500

TuxCare rebuilt http-proxy-middleware to address 3 CVEs. Fixed in 1.3.1-tuxcare.1...

The vulnerability of the http_proxy_connect() function in the RDP client FreeRDP allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the httpproxyconnect function in the RDP client FreeRDP is related to the lack of handling for CRLF sequences in HTTP headers when processing the variable ServerHostname. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and...

Important: python3

Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...

MGASA-2026-0315 Updated libvncserver packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Heap Out-of-Bounds Read in HandleUltraZipBPP due to unchecked subrectangle count. CVE-2026-32853 NULL pointer dereferences in httpd proxy handlers via malformed CONNECT/GET requests. CVE-2026-32854 LibVNCClient Tight Gradient decoding allows...

CVE-2026-67320

A flaw was found in axios when used in a Node.js deployment with the HTTP adapter. This vulnerability, known as Prototype Pollution, occurs because request interceptors can revert hardened request configurations, allowing an attacker to manipulate the Object.prototype.proxy property. If...

toolbox v0.2.1

-Significant%20AI%2C%20fully%20reviewed-1f77b4 MCP-based application security testing tools for your coding agent. Not a scanner — a collaborative workbench. Agents struggle with UI and stateful APIs; you're good at both. Sectool lets you explore an application through its proxy while an agent...

CVE-2026-67289

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...

CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection

FreeRDP before 3.29.0 affected versions = 3.28.0 does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the...