burpflow

BurpFlow BurpFlow is a lightweight Node.js CLI tool that routes HTTP requests through a Burp Suite proxy, enabling security testers to quickly load and analyze reconnaissance URLs inside Burp. 🎯 What is BurpFlow? BurpFlow is a fast, efficient, and minimal recon automation CLI tool designed for...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 HTTP Header Injection via Proxy Routing Token

FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the target portion of a routing token Cookie: msts= is not rejected and is written by httpproxyconnect into the CONNECT request line and Host header. A remote unauthenticated RDP client connecting to a prox...

CVE-2026-84394

fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the ho...

Information Disclosure axios Dependency in Jira Service Management Data Center

This High severity Information Disclosure vulnerability was introduced in versions 10.3.22 and 11.3.7 of Jira Service Management Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to Object.prototype.proxy being able to influence the Node HTTP adapter through an un-rehardened request configuration, allowing an attacker who can pollute the prototype to route requests through an attacker-controlled proxy...

SUSE CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

UBUNTU-CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-69246

CVE-2026-69246 affects the PHP HTTP client Guzzle. Before versions 7.15.2 and 8.0.1, Guzzle passes the request URI to the transport as text and separately provides a Host header. The cURL handlers set CURLOPT_URL to the URI as written and push the Host into CURLOPT_HTTPHEADER; StreamHandler does ...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-69246

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

Information Disclosure axios Dependency in Bitbucket Data Center

This High severity Information Disclosure vulnerability was introduced in versions 9.4.21, 10.2.4, and 10.3.1 of Bitbucket Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows ...

Information Disclosure axios Dependency in Crowd Data Center

This High severity Information Disclosure vulnerability was introduced in version 7.2.1 of Crowd Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows an unauthenticated attacke...

PT-2026-67523

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT URL to the URI exactly as written and push that Host into CURLOPT HTTPHEADER; StreamHandler does the same...

Linux Distros Unpatched Vulnerability : CVE-2026-67320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by...

GHSA-68JP-44VC-2X5H Duplicate Advisory: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gcfj-64vw-6mp9. This link is maintained to preserve external references. Original Description axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios...

CVE-2026-67315

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NOPROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local...

CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

CVE-2026-67320 axios before 0.33.0 Prototype Pollution via Node HTTP adapter

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...