Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

CVE-2026-42043

**1. Executive Summary** This report documents an **incomplete security patch** for the previously disclosed vulnerabili

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`

CVE-2026-42044

# Vulnerability Disclosure: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` ## Summa

历史摘要 · 未重新核验 · GitHub Advisory

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

CVE-2026-42264

## Summary Five config properties in the HTTP adapter are read via direct property access without `hasOwnProperty` guar

历史摘要 · 未重新核验 · GitHub Advisory

Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

CVE-2026-42040

# Vulnerability Disclosure: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams ## Summary The `encode()`

历史摘要 · 未重新核验 · GitHub Advisory

phpVMS has an /importer authorization bypass causing full database wipe

CVE-2026-42569

# Security Advisory: Unauthenticated Access to Legacy Import Feature **Severity:** Critical **Affected versions:** phpV

历史摘要 · 未重新核验 · GitHub Advisory

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

CVE-2026-42605

## Summary The `currentDirectory` request parameter in the Flow.js media upload endpoint (`POST /api/station/{station_i

历史摘要 · 未重新核验 · GitHub Advisory

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

CVE-2026-41901

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and includi

历史摘要 · 未重新核验 · GitHub Advisory

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

CVE-2026-42183

### Summary A nil pointer dereference in `server/auth/gatekeeper.go` `rbacAuthorization()` causes a panic (denial of ser

历史摘要 · 未重新核验 · GitHub Advisory

Firewall for AI

Akamai 发布了 Firewall for AI 产品，这是一种专门为人工智能应用设计的网络安全防护方案。该产品旨在保护 AI 服务（如大型语言模型 API）免受分布式拒绝服务（DDoS）攻击和僵尸网络入侵。随着 AI 应用的普及，攻击

历史摘要 · 未重新核验 · Akamai Security Research

EvoPoC: Automated Exploit Synthesis for DeFi Smart Contracts via Hierarchical Knowledge Graphs

本文提出 EvoPoC，一个基于分层知识图谱（HKG）的端到端智能合约漏洞检测与利用自动合成系统。核心动机在于：发现漏洞与证明其可被利用之间存在巨大鸿沟，手动构造 PoC 耗时且易遗漏。EvoPoC 将利用合成视为结构化推理问题，而非代码生

历史摘要 · 未重新核验 · arXiv cs.CR

CrowdStrike Named a Leader in Frost & Sullivan 2026 Radar for Cloud-Native Application Protection Platforms

2026年5月5日，CrowdStrike宣布被Frost & Sullivan评为云原生应用保护平台（CNAPP）领域的领导者。该奖项基于Frost & Sullivan的2026年度雷达报告，该报告评估了多家CNAPP提供商的市场表现、

历史摘要 · 未重新核验 · CrowdStrike

CrowdStrike Expands Real-Time Cloud Detection and Response to Google Cloud

CrowdStrike 于 2026 年 5 月 5 日宣布，其 Falcon 平台现已扩展对 Google Cloud 环境的实时检测与响应（D&R）支持。此举使得在 Google Cloud 上运行的工作负载能够受益于 CrowdStr

历史摘要 · 未重新核验 · CrowdStrike

CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection

CrowdStrike Falcon Cloud Security Delivered 264% ROI Through Unified Cloud Protection

历史摘要 · 未重新核验 · CrowdStrike

Security & Identity

Security & Identity

历史摘要 · 未重新核验 · Mandiant

SAP on Google Cloud

SAP on Google Cloud

历史摘要 · 未重新核验 · Mandiant

Inside Google Cloud

Inside Google Cloud

历史摘要 · 未重新核验 · Mandiant

Google Cloud Next & Events

Google Cloud Next & Events

历史摘要 · 未重新核验 · Mandiant

Google Cloud Consulting

Google Cloud Consulting

历史摘要 · 未重新核验 · Mandiant

Transform with Google Cloud

Transform with Google Cloud

历史摘要 · 未重新核验 · Mandiant

Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Google Threat Intelligence Group • 16-minute read

Threat IntelligenceNorth Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain AttackBy Goo

历史摘要 · 未重新核验 · Mandiant