https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T05:04:35.717697+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-198433 EUVD-2026-198433 2026-10-05T05:04:35.806936+00:00 EUVD-2026-198433 https://cve.radiocsirt.org/vuln/fkie_cve-2024-10491 fkie_cve-2024-10491 2026-10-05T05:04:35.806986+00:00

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

 https://cve.radiocsirt.org/vuln/ghsa-cm5g-3pgc-8rg4 GHSA-cm5g-3pgc-8rg4 — Express ressource injection 2026-10-05T05:04:35.807043+00:00

Affected: npm: express

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.

The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.

This vulnerability is especially relevant for dynamic parameters.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-10491 Withdrawn: UBUNTU-CVE-2024-10491 2026-10-05T05:04:35.807088+00:00

Withdrawn by the publisher.

Affected: Ubuntu:Pro:16.04:LTS: node-express, Ubuntu:Pro:18.04:LTS: node-express, Ubuntu:Pro:20.04:LTS: node-express, Ubuntu:22.04:LTS: node-express, Ubuntu:24.10: node-express, Ubuntu:24.04:LTS: node-express, Ubuntu:25.04: node-express

A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.