Axios: Header Injection via Inherited headers After Minimal Interceptor
CVE-2026-101904
Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
CVE-2026-101903
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular express
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
CVE-2026-101902
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-ins
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
CVE-2026-101901
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not insta
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
CVE-2026-101900
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherite
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
CVE-2026-101898
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup d
Fleet applies namespace labels and annotations without the bundle's service account privileges
CVE-2026-93540
A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLa
Apache Roller: Stored cross-site scripting in the authoring UI
CVE-2026-82381
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a use
Apache Roller: Stored javascript: URI in HTML comments
CVE-2026-91204
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an an
Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
CVE-2026-101090
Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard
Obot before v0.23.0 Server-Side Request Forgery via MCP
CVE-2026-101064
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows p
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a c...
CVE-2026-82378
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote
PLANET VDR-300NU ADSL Router - 未授权修改DNS
PLANET VDR-300NU ADSL Router - 未授权修改DNS
Acknowledgements
Acknowledgements
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue...
CVE-2026-101188
A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
CVE-2026-83557
### Summary `DefaultBaseTypeLimitingValidator` — the `PolymorphicTypeValidator` used automatically whenever `@JsonTypeIn
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
CVE-2026-101913
### Summary `Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`. Link-local unicast is the whole `/
StallGrid: Measuring Internet-exposed Engagement in Protocol-Native OT Tarpits
操作技术（OT）系统长期暴露于扫描和协议专用攻击工具之下，一旦被攻陷可能扰乱物理过程而非仅泄露数据。传统 OT 防御依赖阻断与过滤，且严格受限于补丁约束；而 tarpit（协议拖延）通过持续协议层交互来延迟扫描器。Modbus TCP 与
Firefox browsers
Firefox browsers
Sign in to Cloud
Sign in to Cloud