https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 07:13:35 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-162415 EUVD-2026-162415 https://cve.radiocsirt.org/vuln/euvd-2026-162415 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43796 <p>Express.js minimalist web framework for node. In express &lt; 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.</p> <p>Express.js minimalist web framework for node. In express &lt; 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-43796 https://cve.radiocsirt.org/vuln/ghsa-qw6h-vgh9-j6wx <p><strong>Affected:</strong> npm: express</p> <p>### Impact</p> <p>In express &lt;4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code</p> <p>### Patches</p> <p>this issue is patched in express 4.20.0</p> <p>### Workarounds</p> <p>users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist</p> <p>### Details</p> <p>successful exploitation of this vector requires the following:</p> <p>1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template</p> <p><strong>Affected:</strong> npm: express</p> <p>### Impact</p> <p>In express &lt;4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code</p> <p>### Patches</p> <p>this issue is patched in express 4.20.0</p> <p>### Workarounds</p> <p>users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist</p> <p>### Details</p> <p>successful exploitation of this vector requires the following:</p> <p>1. The attacker MUST control the input to response.redirect() 1. express MUST NOT redirect before the template appears 1. the browser MUST NOT complete redirection before: 1. the user MUST click on the link in the template</p> https://cve.radiocsirt.org/vuln/ghsa-qw6h-vgh9-j6wx https://cve.radiocsirt.org/vuln/msrc_cve-2024-43796 msrc_CVE-2024-43796 https://cve.radiocsirt.org/vuln/msrc_cve-2024-43796 https://cve.radiocsirt.org/vuln/ncsc-2026-0031 NCSC-2026-0031 https://cve.radiocsirt.org/vuln/ncsc-2026-0031 https://cve.radiocsirt.org/vuln/rhba-2024:7523 <p>micromatch: vulnerable to Regular Expression Denial of Service braces: fails to limit the number of characters it can handle dset: Prototype Pollution golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses net/http: Denial of service due to improper 100-continue handling in net/http azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity urllib3: proxy-authorization request header is not stripped during cross-origin redirects fast-loops: prototype pollution via objectMergeDeep nodejs-async: Regular expression denial of service while parsing function in autoinject express: Improper Input Handling in Express Redirects serve-static: Improper Sanitization in serve-static</p> <p>micromatch: vulnerable to Regular Expression Denial of Service braces: fails to limit the number of characters it can handle dset: Prototype Pollution golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses net/http: Denial of service due to improper 100-continue handling in net/http azure-identity: Azure Identity Libraries Elevation of Privilege Vulnerability in github.com/Azure/azure-sdk-for-go/sdk/azidentity urllib3: proxy-authorization request header is not stripped during cross-origin redirects fast-loops: prototype pollution via objectMergeDeep nodejs-async: Regular expression denial of service while parsing function in autoinject express: Improper Input Handling in Express Redirects serve-static: Improper Sanitization in serve-static</p> https://cve.radiocsirt.org/vuln/rhba-2024:7523 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43796 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: node-express, Ubuntu:Pro:18.04:LTS: node-express, Ubuntu:Pro:20.04:LTS: node-express, Ubuntu:Pro:22.04:LTS: node-express, Ubuntu:Pro:24.04:LTS: node-express</p> <p>Express.js minimalist web framework for node. In express &lt; 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: node-express, Ubuntu:Pro:18.04:LTS: node-express, Ubuntu:Pro:20.04:LTS: node-express, Ubuntu:Pro:22.04:LTS: node-express, Ubuntu:Pro:24.04:LTS: node-express</p> <p>Express.js minimalist web framework for node. In express &lt; 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-43796 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um einen Cross-Site Scripting und Server-Side Request Forgery-Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2197