CVE-2026-66339
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorizati
CVSS
6.5
Medium
EPSS
0.2%
p14
KEV
—
Exploit Today
4
0-100
Published: Jul 24, 2026 · Last modified: Jul 24, 2026 · CWE-201
0.2%EPSS · 30 days0.2%
2026-07-252026-07-26
A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-654346.5 MED—
———Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.6hCVE-2026-167986.5 MED12.5%
——4Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.3dCVE-2026-273726.5 MED18.7%
——6Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.4dCVE-2026-125473.4 LOW13.7%
——4SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.6dCVE-2026-13380—17.8%
——5VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.4dCVE-2026-541716.5 MED24.0%
——7Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0.4d