CVE-2026-68148

Summary: CVE-2026-68148 fixes a use-after-free in fscrypt by adding a missing super_block pointer comparison when locating fscrypt_direct_key entries. Previously, inodes with different super_blocks could share the same fscrypt_direct_key, allowing the key’s lifetime to outlive its super_block. Im...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to use of the in operator in the mergeDirectKeys strategy for validateStatus, which traverses the prototype chain, allowing a polluted Object.prototype.validateStatus to override behavior and treat all HTTP responses as...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via the mergeDirectKeys function in mergeConfig. An attacker can force a request configuration to inherit attacker-controlled properti...