https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:23:18 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/cleanstart-2026-ed19767 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Package opensearch-dashboards-fips version 3.6.0-r4 fixes 7 vulnerabilities: ghsa-cmwh-pvxp-8882, CVE-2026-12143, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Package opensearch-dashboards-fips version 3.6.0-r4 fixes 7 vulnerabilities: ghsa-cmwh-pvxp-8882, CVE-2026-12143, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ed19767 https://cve.radiocsirt.org/vuln/euvd-2026-366753 EUVD-2026-366753 https://cve.radiocsirt.org/vuln/euvd-2026-366753 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12143 <p>form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (&#34;) characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `&#34;` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.</p> <p>form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (&#34;) characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `&#34;` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12143 https://cve.radiocsirt.org/vuln/ghsa-hmw2-7cc7-3qxx <p><strong>Affected:</strong> npm: form-data</p> <p>## Summary</p> <p>`form-data` builds `multipart/form-data` request bodies. Through v4.0.5, the `field` name passed to `FormData#append` and the `filename` option are concatenated directly into the `Content-Disposition` header with no escaping of CR (`\r`), LF (`\n`), or `&#34;`. An application that uses **untrusted input as a field name or filename** therefore lets an attacker terminate the header line and either inject additional headers or smuggle whole additional multipart parts into the request the application forwards to a backend.</p> <p>This is CWE-93 (CRLF injection). It is a divergence from how browsers and the WHATWG HTML spec serialize form-data (they escape these characters), so the fix is to match that behavior. Severity is **conditional**: it depends on the consuming application passing attacker-controlled data as a field name or filename. Applications that only use fixed/trusted field names are not affected.</p> <p>## Details</p> <p>In `lib/form_data.js`, `_multiPartHeader` builds the part header as:</p> <p>```javascript &#39;Content-Disposition&#39;: [&#39;form-data&#39;, &#39;name=&#34;&#39; + field + &#39;&#34;&#39;].concat(contentDisposition || []) ```</p> <p>and `_getContentDisposition` builds `filename=&#34;&#39; + filename + &#39;&#34;&#39;`. Neither escapes control characters, so a `\r\n` in `field`/`filename` ends the header line. The same applies to `&#34;`, which can break out of the quoted parameter.</p> <p>### Proof of concept</p> <p>```javascript const FormData = require(&#39;form-data&#39;); const form = new FormData(); form.append(&#39;email&#34;\r\nX-Injected: true\r\nfake…</p> <p><strong>Affected:</strong> npm: form-data</p> <p>## Summary</p> <p>`form-data` builds `multipart/form-data` request bodies. Through v4.0.5, the `field` name passed to `FormData#append` and the `filename` option are concatenated directly into the `Content-Disposition` header with no escaping of CR (`\r`), LF (`\n`), or `&#34;`. An application that uses **untrusted input as a field name or filename** therefore lets an attacker terminate the header line and either inject additional headers or smuggle whole additional multipart parts into the request the application forwards to a backend.</p> <p>This is CWE-93 (CRLF injection). It is a divergence from how browsers and the WHATWG HTML spec serialize form-data (they escape these characters), so the fix is to match that behavior. Severity is **conditional**: it depends on the consuming application passing attacker-controlled data as a field name or filename. Applications that only use fixed/trusted field names are not affected.</p> <p>## Details</p> <p>In `lib/form_data.js`, `_multiPartHeader` builds the part header as:</p> <p>```javascript &#39;Content-Disposition&#39;: [&#39;form-data&#39;, &#39;name=&#34;&#39; + field + &#39;&#34;&#39;].concat(contentDisposition || []) ```</p> <p>and `_getContentDisposition` builds `filename=&#34;&#39; + filename + &#39;&#34;&#39;`. Neither escapes control characters, so a `\r\n` in `field`/`filename` ends the header line. The same applies to `&#34;`, which can break out of the quoted parameter.</p> <p>### Proof of concept</p> <p>```javascript const FormData = require(&#39;form-data&#39;); const form = new FormData(); form.append(&#39;email&#34;\r\nX-Injected: true\r\nfake…</p> https://cve.radiocsirt.org/vuln/ghsa-hmw2-7cc7-3qxx https://cve.radiocsirt.org/vuln/msrc_cve-2026-12143 msrc_CVE-2026-12143 https://cve.radiocsirt.org/vuln/msrc_cve-2026-12143 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21448-1 <p>Security update for agama-web-ui</p> <p>Security update for agama-web-ui</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21448-1 https://cve.radiocsirt.org/vuln/rhsa-2026:33155 <p>form-data: form-data: Form field override via CRLF injection golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input axios: Axios: Information disclosure of proxy credentials via HTTP redirects axios: Axios: Information disclosure of proxy credentials via redirect flows axios: Axios: Denial of Service due to unenforced request and response size limits axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution axios: Axios: Information disclosure due to prototype pollution vulnerability axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments</p> <p>form-data: form-data: Form field override via CRLF injection golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input axios: Axios: Information disclosure of proxy credentials via HTTP redirects axios: Axios: Information disclosure of proxy credentials via redirect flows axios: Axios: Denial of Service due to unenforced request and response size limits axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution axios: Axios: Information disclosure due to prototype pollution vulnerability axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments</p> https://cve.radiocsirt.org/vuln/rhsa-2026:33155 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-12143 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: node-form-data, Ubuntu:Pro:16.04:LTS: node-form-data, Ubuntu:Pro:18.04:LTS: node-form-data, Ubuntu:Pro:20.04:LTS: node-form-data, Ubuntu:Pro:22.04:LTS: node-form-data, Ubuntu:24.04:LTS: node-form-data, Ubuntu:25.10: node-form-data, Ubuntu:26.04:LTS: node-form-data</p> <p>form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (&#34;) characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `&#34;` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: node-form-data, Ubuntu:Pro:16.04:LTS: node-form-data, Ubuntu:Pro:18.04:LTS: node-form-data, Ubuntu:Pro:20.04:LTS: node-form-data, Ubuntu:Pro:22.04:LTS: node-form-data, Ubuntu:24.04:LTS: node-form-data, Ubuntu:25.10: node-form-data, Ubuntu:26.04:LTS: node-form-data</p> <p>form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (&#34;) characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `&#34;` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-12143 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2460 <p>Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2460