https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:42:16 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0934 certfr-2026-avi-0934 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0934 https://cve.radiocsirt.org/vuln/cleanstart-2026-ed19767 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Package opensearch-dashboards-fips version 3.6.0-r4 fixes 7 vulnerabilities: ghsa-cmwh-pvxp-8882, CVE-2026-12143, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: opensearch-dashboards-fips</p> <p>Package opensearch-dashboards-fips version 3.6.0-r4 fixes 7 vulnerabilities: ghsa-cmwh-pvxp-8882, CVE-2026-12143, CVE-2026-46625, CVE-2026-53550, CVE-2026-53655...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ed19767 https://cve.radiocsirt.org/vuln/euvd-2026-365507 EUVD-2026-365507 https://cve.radiocsirt.org/vuln/euvd-2026-365507 https://cve.radiocsirt.org/vuln/fkie_cve-2026-46625 <p>JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie&#39;s internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object&#39;s &#34;__proto__&#34; member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.</p> <p>JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie&#39;s internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object&#39;s &#34;__proto__&#34; member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-46625 https://cve.radiocsirt.org/vuln/ghsa-qjx8-664m-686j <p><strong>Affected:</strong> npm: js-cookie</p> <p>## Summary</p> <p>`js-cookie`&#39;s internal `assign()` helper copies properties with `for...in` + plain assignment. When the source object is produced by `JSON.parse`, the JSON object&#39;s `&#34;__proto__&#34;` member is an *own enumerable* property, so the `for…in` enumerates it and the `target[key] = source[key]` write triggers the **`Object.prototype.__proto__` setter** on the fresh `target` (`{}`). The result is a per-instance prototype hijack: `Object.prototype` itself is untouched, but the merged `attributes` object now inherits attacker-controlled keys.</p> <p>Because the consuming `set()` function then enumerates the merged object with another `for...in`, every key the attacker placed on the polluted prototype lands in the resulting `Set-Cookie` string as an attribute pair. The attacker can set `domain=`, `secure=`, `samesite=`, `expires=`, and `path=` on cookies whose attributes the developer thought were locked down.</p> <p>## Impact</p> <p>Any application that forwards a JSON-derived object as the `attributes` argument to `Cookies.set`, `Cookies.remove`, `Cookies.withAttributes`, or `Cookies.withConverter` is vulnerable. This is the standard pattern when cookie configuration comes from a backend:</p> <p>```js const cfg = await fetch(&#39;/config&#39;).then(r =&gt; r.json()); Cookies.set(&#39;session&#39;, token, cfg.cookieAttrs); // cfg.cookieAttrs influenced by attacker ```</p> <p>A payload of `{&#34;__proto__&#34;:{&#34;domain&#34;:&#34;evil.example&#34;,&#34;secure&#34;:&#34;false&#34;,&#34;samesite&#34;:&#34;None&#34;}}` causes js-cookie to emit:</p> <p>``` Set-Cookie: session=TOKEN; pa…</p> <p><strong>Affected:</strong> npm: js-cookie</p> <p>## Summary</p> <p>`js-cookie`&#39;s internal `assign()` helper copies properties with `for...in` + plain assignment. When the source object is produced by `JSON.parse`, the JSON object&#39;s `&#34;__proto__&#34;` member is an *own enumerable* property, so the `for…in` enumerates it and the `target[key] = source[key]` write triggers the **`Object.prototype.__proto__` setter** on the fresh `target` (`{}`). The result is a per-instance prototype hijack: `Object.prototype` itself is untouched, but the merged `attributes` object now inherits attacker-controlled keys.</p> <p>Because the consuming `set()` function then enumerates the merged object with another `for...in`, every key the attacker placed on the polluted prototype lands in the resulting `Set-Cookie` string as an attribute pair. The attacker can set `domain=`, `secure=`, `samesite=`, `expires=`, and `path=` on cookies whose attributes the developer thought were locked down.</p> <p>## Impact</p> <p>Any application that forwards a JSON-derived object as the `attributes` argument to `Cookies.set`, `Cookies.remove`, `Cookies.withAttributes`, or `Cookies.withConverter` is vulnerable. This is the standard pattern when cookie configuration comes from a backend:</p> <p>```js const cfg = await fetch(&#39;/config&#39;).then(r =&gt; r.json()); Cookies.set(&#39;session&#39;, token, cfg.cookieAttrs); // cfg.cookieAttrs influenced by attacker ```</p> <p>A payload of `{&#34;__proto__&#34;:{&#34;domain&#34;:&#34;evil.example&#34;,&#34;secure&#34;:&#34;false&#34;,&#34;samesite&#34;:&#34;None&#34;}}` causes js-cookie to emit:</p> <p>``` Set-Cookie: session=TOKEN; pa…</p> https://cve.radiocsirt.org/vuln/ghsa-qjx8-664m-686j https://cve.radiocsirt.org/vuln/ncsc-2026-0325 NCSC-2026-0325 https://cve.radiocsirt.org/vuln/ncsc-2026-0325 https://cve.radiocsirt.org/vuln/rhsa-2026:33183 <p>form-data: form-data: Form field override via CRLF injection golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input axios: Axios: Information disclosure of proxy credentials via HTTP redirects axios: Axios: Information disclosure of proxy credentials via redirect flows axios: Axios: Denial of Service due to unenforced request and response size limits axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution axios: Axios: Information disclosure due to prototype pollution vulnerability axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments</p> <p>form-data: form-data: Form field override via CRLF injection golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input axios: Axios: Information disclosure of proxy credentials via HTTP redirects axios: Axios: Information disclosure of proxy credentials via redirect flows axios: Axios: Denial of Service due to unenforced request and response size limits axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution axios: Axios: Information disclosure due to prototype pollution vulnerability axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name js-cookie: JavaScript Cookie: Cookie attribute manipulation via prototype pollution ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments</p> https://cve.radiocsirt.org/vuln/rhsa-2026:33183 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46625 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-js-cookie, Ubuntu:20.04:LTS: node-js-cookie, Ubuntu:22.04:LTS: node-js-cookie, Ubuntu:24.04:LTS: node-js-cookie, Ubuntu:25.10: node-js-cookie, Ubuntu:26.04:LTS: node-js-cookie</p> <p>JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie&#39;s internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object&#39;s &#34;__proto__&#34; member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: node-js-cookie, Ubuntu:20.04:LTS: node-js-cookie, Ubuntu:22.04:LTS: node-js-cookie, Ubuntu:24.04:LTS: node-js-cookie, Ubuntu:25.10: node-js-cookie, Ubuntu:26.04:LTS: node-js-cookie</p> <p>JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie&#39;s internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object&#39;s &#34;__proto__&#34; member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototype.__proto__ setter on the fresh target ({}). The result is a per-instance prototype hijack: Object.prototype itself is untouched, but the merged attributes object now inherits attacker-controlled keys. Because the consuming set() function then enumerates the merged object with another for...in, every key the attacker placed on the polluted prototype lands in the resulting Set-Cookie string as an attribute pair. The attacker can set domain=, secure=, samesite=, expires=, and path= on cookies whose attributes the developer thought were locked down. This issue has been patched in version 3.0.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-46625 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2299 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um Daten zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2299