https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 20:08:28 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 https://cve.radiocsirt.org/vuln/euvd-2026-293135 EUVD-2026-293135 https://cve.radiocsirt.org/vuln/euvd-2026-293135 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42038 <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42038 https://cve.radiocsirt.org/vuln/ghsa-m7pr-hjqh-92cm <p><strong>Affected:</strong> npm: axios</p> <p>The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it.</p> <p>The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. As a result: - no_proxy=localhost does NOT block 127.0.0.1 or [::1] - no_proxy=127.0.0.1 does NOT block localhost or [::1]</p> <p>POC : process.env.no_proxy = &#39;localhost&#39;; process.env.http_proxy = &#39;http://attacker-proxy:8888&#39;;</p> <p>```(base) srisowmyanemani@Srisowmyas-MacBook-Pro axios % &gt;.... process.env.http_proxy = &#39;http://127.0.0.1:8888&#39;;</p> <p>console.log(&#39;=== Test 1: localhost (should bypass proxy) ===&#39;); try { await axios.get(&#39;http://localhost:7777/&#39;); } catch(e) { console.log(&#39;Error:&#39;, e.message); }</p> <p>console.log(&#39;&#39;); console.log(&#39;=== Test 2: 127.0.0.1 (should ALSO bypass proxy but DOES NOT) ===&#39;); try { await axios.get(&#39;http://127.0.0.1:7777/&#39;); } catch(e) { console.log(&#39;Error:&#39;, e.message); }</p> <p>fakeProxy.close(); internalServer.close(); }); }); EOF === Test 1: localhost (should bypass proxy) === ✅ Internal server hit directly (correct)</p> <p>=== Test 2: 127.0.0.1 (should ALSO bypass proxy but DOES NOT) === 🚨 PROXY RECEIVED REQUEST TO: http://127.0.0.1:7777/ 🚨 Host header: 127.0.0.1:7777. ```</p> <p>&lt;img width=&#34;1212&#34; height=&#34;247&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/asset…</p> <p><strong>Affected:</strong> npm: axios</p> <p>The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it.</p> <p>The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. As a result: - no_proxy=localhost does NOT block 127.0.0.1 or [::1] - no_proxy=127.0.0.1 does NOT block localhost or [::1]</p> <p>POC : process.env.no_proxy = &#39;localhost&#39;; process.env.http_proxy = &#39;http://attacker-proxy:8888&#39;;</p> <p>```(base) srisowmyanemani@Srisowmyas-MacBook-Pro axios % &gt;.... process.env.http_proxy = &#39;http://127.0.0.1:8888&#39;;</p> <p>console.log(&#39;=== Test 1: localhost (should bypass proxy) ===&#39;); try { await axios.get(&#39;http://localhost:7777/&#39;); } catch(e) { console.log(&#39;Error:&#39;, e.message); }</p> <p>console.log(&#39;&#39;); console.log(&#39;=== Test 2: 127.0.0.1 (should ALSO bypass proxy but DOES NOT) ===&#39;); try { await axios.get(&#39;http://127.0.0.1:7777/&#39;); } catch(e) { console.log(&#39;Error:&#39;, e.message); }</p> <p>fakeProxy.close(); internalServer.close(); }); }); EOF === Test 1: localhost (should bypass proxy) === ✅ Internal server hit directly (correct)</p> <p>=== Test 2: 127.0.0.1 (should ALSO bypass proxy but DOES NOT) === 🚨 PROXY RECEIVED REQUEST TO: http://127.0.0.1:7777/ 🚨 Host header: 127.0.0.1:7777. ```</p> <p>&lt;img width=&#34;1212&#34; height=&#34;247&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/asset…</p> https://cve.radiocsirt.org/vuln/ghsa-m7pr-hjqh-92cm https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42038 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42038 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1450 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, wodurch weitere Angriffe möglich werden.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, wodurch weitere Angriffe möglich werden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1450