CVE-2026-101907

The Axios promise-based HTTP client (versions 1.17.0 through 1.20.0 ) contains a vulnerability where the fetch adapter fails to enforce the maxRedirects: 0 policy. When an Axios request using this adapter receives a redirect response, the underlying fetch implementation follows the redirect inste...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-101900

The Axios HTTP client (versions 1.12.0 to 1.20.0 ) is vulnerable to a Fetch Adapter Header Injection flaw. The issue occurs because ResolveConfig reads inherited properties—specifically Symbol.toStringTag, append, and getHeaders—while resolving FormData headers. This can be exploited via a separa...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

A flaw was found in the Linux kernel's mana network driver. This Time-of-Check to Time-of-Use TOCTOU vulnerability allows a hardware component to modify a message identifier hwcmsgid in Direct Memory Access DMA memory after it has been validated but before it is used. This manipulation bypasses...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

CVE-2026-100893 Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

CVE-2026-100893 Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

ipa security, bug fix, and enhancement update

4.13.4-1.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 - Add bind to ipa-server-common Requires Orabug: 36518596 4.13.4-1 - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval reachable before authorization check allows environment disclosure and denial of...

CVE-2026-101908: Improperly Controlled Modification of Object Prototype Attributes

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...

PT-2026-99939

Name of the Vulnerable Software and Affected Versions Axios versions 1.12.0 through 1.19.x Description While resolving FormData headers, the ResolveConfig function reads inherited Symbol.toStringTag, append, and getHeaders properties. A prototype pollution flaw allows an attacker to provide an...

CVE-2026-101900: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

CVE-2026-100893: Server-Side Request Forgery (SSRF)

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

CVE-2026-101907: Unintended Proxy or Intermediary

Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation...

PT-2026-99951

Name of the Vulnerable Software and Affected Versions Axios versions 1.7.0 through 1.19.x Description The fetch adapter constructs a Request using sanitized resolvedOptions but subsequently invokes fetch using the original fetchOptions. Due to a same-process prototype pollution flaw—where...

PT-2026-99950

Name of the Vulnerable Software and Affected Versions Axios versions 1.17.0 through 1.19.x Description The fetch adapter bypasses the maxRedirects: 0 redirect policy. When a request is configured with maxRedirects set to zero and receives a redirect response, the underlying fetch implementation...

DEBIAN-CVE-2026-100693

Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that allows attackers to bypass restrictions. Attackers can use mixed-case URL schemes in resources.GetRemote calls to fetch from restricted IP addresses like...