https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T22:31:21.532464+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-174406 EUVD-2026-174406 2026-10-22T22:31:21.535080+00:00 EUVD-2026-174406 https://cve.radiocsirt.org/vuln/fkie_cve-2022-25839 fkie_cve-2022-25839 2026-10-22T22:31:21.535112+00:00

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

 https://cve.radiocsirt.org/vuln/ghsa-rf54-44jr-q5vf GHSA-rf54-44jr-q5vf — Improper Input Validation in url-js 2026-10-22T22:31:21.535142+00:00

Affected: npm: url-js

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.

 https://cve.radiocsirt.org/vuln/gsd-2022-25839 gsd-2022-25839 2026-10-22T22:31:21.535166+00:00 gsd-2022-25839