https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:53:39.850264+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-168103 EUVD-2026-168103 2026-10-03T20:53:39.953349+00:00 EUVD-2026-168103 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23518 fkie_cve-2021-23518 2026-10-03T20:53:39.953386+00:00

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

 https://cve.radiocsirt.org/vuln/ghsa-wg6g-ppvx-927h GHSA-wg6g-ppvx-927h — Prototype Pollution in cached-path-relative 2026-10-03T20:53:39.953419+00:00

Affected: npm: cached-path-relative

The package cached-path-relative before 1.1.0 is vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

 https://cve.radiocsirt.org/vuln/gsd-2021-23518 gsd-2021-23518 2026-10-03T20:53:39.953447+00:00 gsd-2021-23518 https://cve.radiocsirt.org/vuln/rhsa-2022:1476 RHSA-2022:1476 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes 2026-10-03T20:53:39.953460+00:00

cached-path-relative: Prototype Pollution via the cache variable nanoid: Information disclosure via valueOf() function opencontainers: OCI manifest and index parsing confusion golang.org/x/crypto: empty plaintext packet causes panic nodejs-shelljs: improper privilege management follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path golang: crash in a golang.org/x/crypto/ssh server

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-23518 UBUNTU-CVE-2021-23518 2026-10-03T20:53:39.953498+00:00

Affected: Ubuntu:18.04:LTS: node-cached-path-relative, Ubuntu:20.04:LTS: node-cached-path-relative, Ubuntu:22.04:LTS: node-cached-path-relative, Ubuntu:24.04:LTS: node-cached-path-relative, Ubuntu:25.10: node-cached-path-relative, Ubuntu:26.04:LTS: node-cached-path-relative

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573