https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:54:24 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-04432 bdu:2022-04432 https://cve.radiocsirt.org/vuln/bdu:2022-04432 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0214 certfr-2025-avi-0214 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0214 https://cve.radiocsirt.org/vuln/euvd-2026-11655 EUVD-2026-11655 https://cve.radiocsirt.org/vuln/euvd-2026-11655 https://cve.radiocsirt.org/vuln/fkie_cve-2022-1365 <p>Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.</p> <p>Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-1365 https://cve.radiocsirt.org/vuln/ghsa-7gc6-qh9x-w6h8 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: cross-fetch</p> <p>## Withdrawn Advisory This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the `Maintainer` comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac.</p> <p>## Original Description When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty. Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: cross-fetch</p> <p>## Withdrawn Advisory This advisory has been withdrawn because the vulnerability originates from a dependency. For more information, see the `Maintainer` comments in https://huntr.com/bounties/ab55dfdd-2a60-437a-a832-e3efe3d264ac.</p> <p>## Original Description When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty. Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .</p> https://cve.radiocsirt.org/vuln/ghsa-7gc6-qh9x-w6h8 https://cve.radiocsirt.org/vuln/gsd-2022-1365 gsd-2022-1365 https://cve.radiocsirt.org/vuln/gsd-2022-1365 https://cve.radiocsirt.org/vuln/rhsa-2022:1681 <p>vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale</p> <p>vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale</p> https://cve.radiocsirt.org/vuln/rhsa-2022:1681