https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:08:21.123234+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2022-avi-345 certfr-2022-avi-345 — De multiples vulnérabilités ont été découvertes dans les produits SAP. Certaines d'entre elles permettent à un attaquan… 2026-10-04T01:08:21.128604+00:00 certfr-2022-avi-345 https://cve.radiocsirt.org/vuln/cnvd-2021-62467 cnvd-2021-62467 2026-10-04T01:08:21.128663+00:00 cnvd-2021-62467 https://cve.radiocsirt.org/vuln/euvd-2026-21027 EUVD-2026-21027 2026-10-04T01:08:21.128680+00:00 EUVD-2026-21027 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3647 fkie_cve-2021-3647 2026-10-04T01:08:21.128694+00:00

URI.js is vulnerable to URL Redirection to Untrusted Site

 https://cve.radiocsirt.org/vuln/ghsa-89gv-h8wf-cg8r GHSA-89gv-h8wf-cg8r — URIjs Vulnerable to Hostname spoofing via backslashes in URL 2026-10-04T01:08:21.128723+00:00

Affected: npm: urijs

### Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https:/\/\/\expected-example.com/path` Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches Version 1.19.7 is patched against all known payload variants.

### References https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass) https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass) [PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information If you…

 https://cve.radiocsirt.org/vuln/gsd-2021-3647 gsd-2021-3647 2026-10-04T01:08:21.128783+00:00 gsd-2021-3647 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3647 UBUNTU-CVE-2021-3647 2026-10-04T01:08:21.128796+00:00

Affected: Ubuntu:20.04:LTS: node-uri-js, Ubuntu:22.04:LTS: node-uri-js, Ubuntu:24.04:LTS: node-uri-js, Ubuntu:25.10: node-uri-js, Ubuntu:26.04:LTS: node-uri-js

URI.js is vulnerable to URL Redirection to Untrusted Site