16829 matches found
GHSA-F2R5-PQH9-R8F8 Duplicate Advisory: Axios: Prototype pollution gadgets can alter axios request construction
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mmx7-hfxf-jppx. This link is maintained to preserve external references. Original Description axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototyp...
PYSEC-2026-3980
GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...
CVE-2026-67326
GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...
CVE-2026-67326
GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...
CVE-2026-67319
axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...
UBUNTU-CVE-2026-67326
GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...
UBUNTU-CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-67326 GitPython before 3.1.50 Newline Injection via config_writer section
GitPython before 3.1.50 fails to validate newline characters in the section parameter of configwriter, allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged core section with hooksPath pointing to attacker-controlled directories,...
CVE-2026-67326
GitPython prior to 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing an attacker to inject arbitrary section headers into .git/config. Attackers can inject newlines to forge a [core] section with hooksPath pointing to attacker-controlled directories...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-15450
The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...
PT-2026-67074
Name of the Vulnerable Software and Affected Versions Nex Forms – Ultimate Form Builder – Lite versions prior to 9.2.4 Description An arbitrary file deletion issue exists due to path traversal. The delete file AJAX handler retrieves a file path from the database and passes it to the unlink functi...
CVE-2026-9044
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...
CVE-2026-9044 Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...
Malicious code in sap-mcp-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...
MAL-2026-11481 Malicious code in sap-mcp-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...
Malicious Package
Overview sap-mcp-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-41851 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry, zipkin...