https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:07:29.631051+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-10943 bdu:2026-10943 2026-10-02T11:07:29.749337+00:00 bdu:2026-10943 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T11:07:29.749383+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/euvd-2026-343719 EUVD-2026-343719 2026-10-02T11:07:29.749412+00:00 EUVD-2026-343719 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67315 fkie_cve-2026-67315 2026-10-02T11:07:29.749436+00:00

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

 https://cve.radiocsirt.org/vuln/ghsa-f4gw-2p7v-4548 GHSA-f4gw-2p7v-4548 — Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios 2026-10-02T11:07:29.749486+00:00

Affected: npm: axios

## Summary

Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it.

The issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when the proxy can reach or relay `0.0.0.0` to local services. This is a Node.js runtime proxy-routing issue, not a browser, install-time, or development-tooling issue.

## Impact

Applications are affected when all of the following are true:

- The application runs axios in Node.js with the HTTP adapter. - The process uses environment proxy variables such as `HTTP_PROXY` or `HTTPS_PROXY`. - The process uses `NO_PROXY` entries such as `localhost`, `127.0.0.1`, or `::1` to keep local traffic out of the proxy path. - Attacker-controlled input can influence the request URL or redirect target. - The configured proxy does not reject `0.0.0.0` and can reach the local destination.

For plain HTTP targets, the proxy can receive the full request URL, headers, and body, and may be able to observe the local service response. HTTPS targets are less exposed because axios uses CONNECT tunneling in current versions.

## Affected Functionality

Affected functionality is limited to environment-derived proxy…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11680-1 openSUSE-SU-2026:11680-1 — agama-web-ui-24+0.a836cced5-52.1 on GA media 2026-10-02T11:07:29.749670+00:00

agama-web-ui-24+0.a836cced5-52.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:49714 RHSA-2026:49714 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T11:07:29.749715+00:00

axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: NO_PROXY bypass allows exposure of local services axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-67315 UBUNTU-CVE-2026-67315 2026-10-02T11:07:29.749757+00:00

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:Pro:26.04:LTS: node-axios

axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2958 WID-SEC-W-2026-2958 — IBM License Metric Tool: Mehrere Schwachstellen 2026-10-02T11:07:29.749807+00:00

Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.