PT-2026-68218

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An HTTP request smuggling issue exists in the HTTP App Server. This occurs when a crafted HTTP request containing both...

Skia Graphic Library DoS

The vulnerability of the Skia graphic library used by Google Chrome and Microsoft Edge is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

Inconsistent Interpretation of HTTP Requests at org.eclipse.jetty:jetty-http dependency in Crucible Server

This is a vulnerability in a non-Atlassian Crucible Server dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Inconsistent Interpretation of HTTP Requests vulnerability was introduced in version 4.9.0 of Crucible Server. Thi...

Important: Red Hat Security Advisory: Satellite 6.19.3 Async Update

A new release is now available for Red Hat Satellite 6.19 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-15314: Buffer Copy without Checking Size of Input

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash...

RHEL 9 : Satellite 6.19.3 Async Update (Important) (RHSA-2026:50221)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50221 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket upgrade. An attacker can bypass request boundaries and interfere with HTTP request processing by crafting specially constructed HTTP requests. Remediation Upgrade aiohttp to version 3.14.2 or...

CVE-2026-69243 AIOHTTP: HTTP request smuggling via WebSocket upgrade

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

PT-2026-76194

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-18394

CVE-2026-18394 affects Strands Agents Tools’ http_request tool prior to v0.8.2, where incorrect authorization could allow an attacker to exfiltrate credentials configured via HTTP_REQUEST_TOKEN_CONFIG by routing requests through proxy infrastructure under attacker control. Root cause: insufficien...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

EUVD-2026-51623

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by a denial of service, HTTP Response and Request Smuggling vulnerabilities when servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Vulnerability Details...

IBM WebSphere Application Server input validation error vulnerability

IBM WebSphere Application Server is an application server product from IBM. Versions 8.5 and 9.0 of IBM WebSphere Application Server have security vulnerabilities. These vulnerabilities stem from input validation flaws in the HTTP request parsing component, leading to inconsistent interpretation ...

EUVD-2026-51230

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request...

Browser HTTP Pivot (Fetch Proxy)

Issue HTTP requests from the hooked browser and return status/headers/body intranet pivot from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Browser HTTP Pivot Fetch Proxy", "description": "Issue HTTP requests from the hooked browser and return status/headers/body...