Linux Distros Unpatched Vulnerability : CVE-2026-101908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions...

Linux Distros Unpatched Vulnerability : CVE-2026-101907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An...

SUSE CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

SUSE CVE-2026-101908

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

CVE-2026-40864

CVE-2026-40864 — JupyterHub XSRF bypass via cross-origin form POST Sec-Fetch-Mode: no-cors Severity : Medium CVSS 5.4 CWE : CWE-352 — Cross-Site Request Forgery XSRF Affected : jupyterhub 4.1.0 ≤ version posting to a different origin — precisely the classic CSRF vector the token is supposed to...

Cross-Site Request Forgery

Apache Wicket is vulnerable to cross-site request forgery. The vulnerability is due to unsafe allowances in the default FetchMetadataResourceIsolationPolicy, where any "simple top-level navigation" GET request is allowed regardless of Sec-Fetch-Site and Sec-Fetch-Mode, and Sec-Fetch-Site: same-si...

CVE-2026-33712

CVE-2026-33712 - Typebot 認証されていないSSRF 説明 Typebot = 3.15.2 3.16.0で修正 には、プレビューチャットエンドポイントに認証されていない Server-Side Request Forgery SSRF 脆弱性が存在します。 エンドポイント: POST /api/v1/typebots/typebotId/preview/startChat プレビューエンドポイントは、ユーザーが指定した typebot 定義とサーバーサイドの Code ブロックを受け入れます。isolated-vm サンドボックス内で公開されている fetch...

CVE-2019-9849

CVE-2019-9849: LibreOffice의 '스텔스 모드'에서 원격 글머리 기호 그래픽이 로드됨 LibreOffice에는 '신뢰할 수 있는' 위치의 문서만 원격 리소스를 가져올 수 있는 '스텔스 모드'가 있습니다. 이 모드는 기본 모드가 아니지만, 문서 내에 원격 리소스를 포함하는 LibreOffice의 기능을 비활성화하려는 사용자가 활성화할 수 있습니다. 6.2.5 이전 버전에서는 글머리 기호 그래픽이 이 보호에서 누락되는 결함이 있었습니다. HTML 태그 | HTML 속성 | 열 때 트리거됨 | 저장/내보낼 때 트리...

Analysis-for-stage1-shellcode-loader-from-hacking-

hacking team의 stage1 셸코드 로더 분석 코드 순서도 네트워크 IoC https://172\.20\.20\.164 Mozilla/4.0 compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; MDDRJS 감염 IoC드롭된 파일 2s5s7k8w8b4i.dat...

CVE-2026-101917

The PyJWT library (versions prior to 2.14.0 ) is vulnerable because the get_signing_key_from_jwt function lacks a negative cache or minimum refresh interval for unknown kid values. This allows an attacker to send unauthenticated tokens with unknown or varying kid values, forcing PyJWKClient to re...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are merged into the...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers...

CVE-2026-101908

A flaw was found in Axios. When using the fetch adapter, Axios fails to properly isolate request configuration options from inherited object properties. If an attacker first exploits a separate prototype pollution vulnerability where shared JavaScript object properties are modified within the...

CVE-2026-101907

A flaw was found in Axios. When configured to use the fetch adapter, the application does not enforce settings configured to disable HTTP redirects. A remote attacker controlling a redirecting server can exploit this behavior to force the application to follow redirects to internal endpoints,...

CVE-2026-101900

A flaw was found in Axios. This vulnerability allows an attacker to manipulate outbound network traffic by injecting arbitrary HTTP Hypertext Transfer Protocol headers. In environments where an attacker can exploit a separate prototype pollution flaw to modify shared object properties, the Axios...

Improper Validation of Specified Quantity in Input

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Improper Validation of Specified Quantity in Input

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...