PT-2026-35047

Name of the Vulnerable Software and Affected Versions Axios versions 1.0.0 through 1.15.0 Description The FormDataPart constructor in lib/helpers/formDataToStream.js interpolates the value.type property directly into the Content-Type header of each multipart part without sanitizing CRLF carriage...

FreeBSD : Python -- HTTP proxy CONNECT tunnel does not sanitize CR/LF (30bda1c3-369b-11f1-b51c-6dd25bec137b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 30bda1c3-369b-11f1-b51c-6dd25bec137b advisory. Seth Larson reports: HTTP proxy via CONNECT tunneling doesn't sanitize CR/LF CVE-2026-1502. Tenable has...