CVE-2026-82806 Apache APISIX: cross-request permission pollution via static permission list mutation

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CVE-2026-82806

Apache APISIX versions 2.3.0 through 3.6.x are vulnerable to a cross-request permission pollution issue when using a supported authz-keycloak configuration. The root cause involves a static permission list mutation where an authorization scope from one request persists into subsequent requests on...

CVE-2026-82806 Apache APISIX: cross-request permission pollution via static permission list mutation

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

Security Bulletin: Multiple vulnerabilities in i18next-http-middleware affect IBM Cloud Pak System

Summary Multiple vulnerabilities in i18next-http-middleware affect IBM Cloud Pak System CVE-2026-41683, CVE-2026-41690, CVE-2026-42353. Vulnerability Details CVEID:CVE-2026-41683 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify an...

Prototype Pollution

axios is vulnerable to prototype pollution. The vulnerability is due to reading form‑serialization option properties without hasOwnProperty guards, where toFormData directly accesses visitor, maxDepth, dots, indexes, metaTokens, and Blob from an options object that may inherit polluted values fro...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to the fetch adapter passing the original fetchOptions to fetch instead of the sanitized resolvedOptions, where inherited Object.prototype.headers overrides the request headers, and an attacker who can pollute the prototype can...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Object.prototype.headers during request configuration normalization, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled HTTP headers, including...

thrift: thrift: Denial of Service via prototype pollution in Node.js bindings

A flaw was found in Apache Thrift's Node.js bindings. Due to improper input validation and prototype pollution—a condition where base JavaScript object properties can be modified—the application fails to safely process incoming data. A remote attacker can exploit this vulnerability by sending...

thrift: thrift: Prototype pollution in JavaScript bindings

A flaw was found in Apache Thrift's JavaScript bindings. An unauthenticated remote attacker can exploit a prototype pollution vulnerability—where shared JavaScript object definitions are modified—by sending specially crafted input to an application using the affected bindings. Successful...

thrift: thrift: Denial of Service via TJSONProtocol in Node.js bindings

A flaw was found in Apache Thrift. A remote attacker can exploit this vulnerability by submitting specially crafted messages to applications using the Node.js bindings with TJSONProtocol. Successful exploitation can trigger an infinite loop or cause prototype pollution unintended modification of...

Prototype Pollution

axios is vulnerable to prototype‑pollution. The vulnerability is due to the default‑instance request code reading an inherited method value from Object.prototype, where the line config.method = config.method || this.defaults.method || 'get'.toLowerCase; falls back to this.defaults.method that can...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Symbol.toStringTag, append, and getHeaders properties during FormData header resolution, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2022_4776)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20224776 advisory. Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla: Prototype pollution in Top-Level Await...

Rocky Linux 10.2 [CIQ] Security Update: cockpit-image-builder Multiple Vulnerabilities (crlsa-2026_24331)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202624331 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 lodash: lodash: Arbitrary code execution via untrusted input in template impor...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2022_9073)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20229073 advisory. nodejs: Improper handling of URI Subject Alternative Names CVE-2021-44531 nodejs: Certificate Verification Bypass via String Injection CVE-2021-44532 nodej...

Rocky Linux 9 [CIQ] Security Update: linux-sgx-debuginfo / linux-sgx-debugsource / sgx-common / sgx-libs / etc Multiple Vulnerabilities (crlsa-2026_18868)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202618868 advisory. qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-15284 node-tar: tar: node-tar: Arbitrary file overwrite and symlink...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2020_4272)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20204272 advisory. nodejs-dot-prop: prototype pollution CVE-2020-8116 nodejs: HTTP request smuggling due to CR-to-Hyphen conversion CVE-2020-8201 npm: Sensitive information...

Rocky Linux 8 [CIQ] Security Update: nodejs-nodemon / nodejs-packaging Multiple Vulnerabilities (crlsa-2021_0548)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20210548 advisory. libuv: buffer overflow in realpath CVE-2020-8252 nodejs-npm-user-validate: improper input validation when validating user emails leads to ReDoS CVE-2020-77...

Rocky Linux 8 [CIQ] Security Update: nodejs / nodejs-debuginfo / nodejs-debugsource / nodejs-devel / etc Multiple Vulnerabilities (crlsa-2023_0050)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230050 advisory. minimist: prototype pollution CVE-2021-44906 node-fetch: exposure of sensitive information to an unauthorized actor CVE-2022-0235 nodejs-minimatch: ReDoS v...

Rocky Linux 9 [CIQ] Security Update: nodejs-nodemon Multiple Vulnerabilities (crlsa-2022_6595)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226595 advisory. nodejs-ini: Prototype pollution via malicious INI file CVE-2020-7788 nodejs-glob-parent: Regular expression denial of service CVE-2020-28469...