https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 18:01:51 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 https://cve.radiocsirt.org/vuln/euvd-2026-366083 EUVD-2026-366083 https://cve.radiocsirt.org/vuln/euvd-2026-366083 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42041 <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript&#39;s in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () =&gt; true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript&#39;s in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () =&gt; true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42041 https://cve.radiocsirt.org/vuln/ghsa-w9j2-pvgh-6h63 <p><strong>Affected:</strong> npm: axios</p> <p># Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy</p> <p>## Summary</p> <p>The Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any `Object.prototype` pollution to **silently suppress all HTTP error responses** (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling.</p> <p>The root cause is that `validateStatus` is the **only** config property using the `mergeDirectKeys` merge strategy, which uses JavaScript&#39;s `in` operator — an operator that inherently traverses the prototype chain. When `Object.prototype.validateStatus` is polluted with `() =&gt; true`, all HTTP status codes are accepted as success.</p> <p>**Severity:** High (CVSS 8.2) **Affected Versions:** All versions (v0.x - v1.x including v1.15.0) **Vulnerable Component:** `lib/core/mergeConfig.js` (`mergeDirectKeys` strategy) + `lib/core/settle.js`</p> <p>## CWE</p> <p>- **CWE-1321:** Improperly Controlled Modification of Object Prototype Attributes (&#39;Prototype Pollution&#39;) - **CWE-287:** Improper Authentication</p> <p>## CVSS 3.1</p> <p>**Score: 8.2 (High)**</p> <p>Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N`</p> <p>| Metric | Value | Justification | |---|---|---| | Attack Vector | Network | PP is triggered remotely | | Attack Complexity | Low | Once PP exists, a single property assignment exploits this. Consistent with GHSA-fvcv-3m26-pcqx | | Privileges Required | None | No au…</p> <p><strong>Affected:</strong> npm: axios</p> <p># Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy</p> <p>## Summary</p> <p>The Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any `Object.prototype` pollution to **silently suppress all HTTP error responses** (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling.</p> <p>The root cause is that `validateStatus` is the **only** config property using the `mergeDirectKeys` merge strategy, which uses JavaScript&#39;s `in` operator — an operator that inherently traverses the prototype chain. When `Object.prototype.validateStatus` is polluted with `() =&gt; true`, all HTTP status codes are accepted as success.</p> <p>**Severity:** High (CVSS 8.2) **Affected Versions:** All versions (v0.x - v1.x including v1.15.0) **Vulnerable Component:** `lib/core/mergeConfig.js` (`mergeDirectKeys` strategy) + `lib/core/settle.js`</p> <p>## CWE</p> <p>- **CWE-1321:** Improperly Controlled Modification of Object Prototype Attributes (&#39;Prototype Pollution&#39;) - **CWE-287:** Improper Authentication</p> <p>## CVSS 3.1</p> <p>**Score: 8.2 (High)**</p> <p>Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N`</p> <p>| Metric | Value | Justification | |---|---|---| | Attack Vector | Network | PP is triggered remotely | | Attack Complexity | Low | Once PP exists, a single property assignment exploits this. Consistent with GHSA-fvcv-3m26-pcqx | | Privileges Required | None | No au…</p> https://cve.radiocsirt.org/vuln/ghsa-w9j2-pvgh-6h63 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 https://cve.radiocsirt.org/vuln/opensuse-su-2026:20919-1 <p>Security update for agama-web-ui</p> <p>Security update for agama-web-ui</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:20919-1 https://cve.radiocsirt.org/vuln/rhsa-2026:14937 <p>axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option axios: Axios: Remote Code Execution via Prototype Pollution escalation follow-redirects: follow-redirects: Information disclosure via cross-domain redirects axios: Axios: HTTP Transport Hijacking via Prototype Pollution axios: Axios: Arbitrary HTTP header injection via prototype pollution axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling axi…</p> <p>axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username OpenSSH: OpenSSH: Information disclosure due to unintended cryptographic algorithm usage OpenSSH: OpenSSH: Low integrity impact from unconfirmed proxy-mode multiplexing sessions OpenSSH: OpenSSH: Security bypass via mishandling of authorized_keys principals option axios: Axios: Remote Code Execution via Prototype Pollution escalation follow-redirects: follow-redirects: Information disclosure via cross-domain redirects axios: Axios: HTTP Transport Hijacking via Prototype Pollution axios: Axios: Arbitrary HTTP header injection via prototype pollution axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling axi…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:14937 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42041 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript&#39;s in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () =&gt; true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios</p> <p>Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution &#34;Gadget&#34; attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys merge strategy, which uses JavaScript&#39;s in operator — an operator that inherently traverses the prototype chain. When Object.prototype.validateStatus is polluted with () =&gt; true, all HTTP status codes are accepted as success. This vulnerability is fixed in 1.15.1 and 0.31.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42041 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1450 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, wodurch weitere Angriffe möglich werden.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, wodurch weitere Angriffe möglich werden.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1450