https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:23:54 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/cleanstart-2026-qx93902 <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: argo-workflows</p> <p>Security vulnerability affects the argo-workflows package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-qx93902 https://cve.radiocsirt.org/vuln/euvd-2026-366770 EUVD-2026-366770 https://cve.radiocsirt.org/vuln/euvd-2026-366770 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13676 <p>fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node&#39;s URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.</p> <p>fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node&#39;s URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13676 https://cve.radiocsirt.org/vuln/ghsa-4c8g-83qw-93j6 <p><strong>Affected:</strong> npm: fast-uri</p> <p>### Impact</p> <p>`fast-uri` versions `&gt;= 2.3.1, &lt;= 4.0.0` fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls `URL.domainToASCII(...)` on the global WHATWG `URL` constructor, where that helper does not exist. The resulting `TypeError` is silently routed into `parsed.error`, but `parse()`, `normalize()`, and `equal()` all return with the host left in its original Unicode form.</p> <p>For example, `http://127。0。0。1/` is treated by `fast-uri` as host `127。0。0。1`, while Node&#39;s WHATWG URL parser and `fetch()` canonicalize the same input to `127.0.0.1`.</p> <p>Applications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL into Node&#39;s URL or `fetch()` consumers see a policy/use desync and can be steered to an unintended destination.</p> <p>### Patches</p> <p>Upgrade to `fast-uri` v4.0.1, v3.1.3, or v2.4.2</p> <p>### Workarounds</p> <p>None. Upgrade to the patched version.</p> <p><strong>Affected:</strong> npm: fast-uri</p> <p>### Impact</p> <p>`fast-uri` versions `&gt;= 2.3.1, &lt;= 4.0.0` fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls `URL.domainToASCII(...)` on the global WHATWG `URL` constructor, where that helper does not exist. The resulting `TypeError` is silently routed into `parsed.error`, but `parse()`, `normalize()`, and `equal()` all return with the host left in its original Unicode form.</p> <p>For example, `http://127。0。0。1/` is treated by `fast-uri` as host `127。0。0。1`, while Node&#39;s WHATWG URL parser and `fetch()` canonicalize the same input to `127.0.0.1`.</p> <p>Applications that use `fast-uri` to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL into Node&#39;s URL or `fetch()` consumers see a policy/use desync and can be steered to an unintended destination.</p> <p>### Patches</p> <p>Upgrade to `fast-uri` v4.0.1, v3.1.3, or v2.4.2</p> <p>### Workarounds</p> <p>None. Upgrade to the patched version.</p> https://cve.radiocsirt.org/vuln/ghsa-4c8g-83qw-93j6 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11160-1 <p>python311-pydata-sphinx-theme-0.19.0-2.1 on GA media</p> <p>python311-pydata-sphinx-theme-0.19.0-2.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11160-1 https://cve.radiocsirt.org/vuln/rhsa-2026:37186 <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: URI authority bypass due to improper delimiter handling webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors</p> <p>lodash: lodash: Arbitrary code execution via untrusted input in template imports fast-uri: fast-uri: URI authority bypass due to improper delimiter handling webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization protobufjs: protobufjs: Arbitrary code execution due to unsafe expression generation from crafted protobuf descriptors</p> https://cve.radiocsirt.org/vuln/rhsa-2026:37186 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13676 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-ajv, Ubuntu:20.04:LTS: node-ajv, Ubuntu:22.04:LTS: node-ajv, Ubuntu:24.04:LTS: node-ajv, Ubuntu:25.10: node-ajv, Ubuntu:26.04:LTS: node-ajv</p> <p>fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node&#39;s URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-ajv, Ubuntu:20.04:LTS: node-ajv, Ubuntu:22.04:LTS: node-ajv, Ubuntu:24.04:LTS: node-ajv, Ubuntu:25.10: node-ajv, Ubuntu:26.04:LTS: node-ajv</p> <p>fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node&#39;s URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13676 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2334 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2334