Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

GHSA-VH66-26GQ-Q6X8 Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

Summary Axios fetch adapter requests can be altered by inherited properties on fetchOptions. The adapter resolves method, headers, body, signal, and credentials into resolvedOptions, creates a Request, and then calls fetchrequest, fetchOptions instead of fetchrequest, resolvedOptions. In runtimes...

OESA-2026-4131 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: The Erlang/OTP httpc HTTP client does not enforce a lim...

CVE-2026-103049

A flaw was found in the MediaWiki Cargo extension. This vulnerability allows a remote attacker to conduct a reflected Cross-Site Scripting XSS attack due to improper input sanitization of table headers on the Special:CargoQuery page. By enticing a user to follow a specially crafted link, an...

Linux Distros Unpatched Vulnerability : CVE-2026-101904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited...

CentOS Linux 8.5 [TuxCare] Security Update: glibc-headers / glibc-langpack-hu / glibc-langpack-sa / etc (CENTOS8.5:CLSA-2025:1750697072)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2025:1750697072 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.2:CLSA-2025:1738695770)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1738695770 advisory. - Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from...

PT-2026-103496

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

CVE-2026-103471: Allocation of Resources Without Limits or Throttling

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2024:1716915132)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1716915132 advisory. - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a...

AlmaLinux 9.2 [TuxCare] Security Update: squid (ALMALINUX9.2:CLSA-2024:1735311253)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1735311253 advisory. - A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a...

Linux Distros Unpatched Vulnerability : CVE-2026-102296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse that allow malicious HTTP cameras or intercepting...

AlmaLinux 9.2 [TuxCare] Security Update: bcc / bcc-devel / bcc-doc / bcc-tools / libbpf-tools / python3-bcc (ALMALINUX9.2:CLSA-2026:1789740903)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789740903 advisory. - If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this t...

Rocky Linux 9.6 [TuxCare] Security Update: libsoup / libsoup-devel / libsoup-doc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776855452)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776855452 advisory. - A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from...

Linux Distros Unpatched Vulnerability : CVE-2026-101908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions...

AlmaLinux 9.2 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel (ALMALINUX9.2:CLSA-2025:1753729945)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1753729945 advisory. - GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

xss-methodology

XSS Methodology Not a payload list. This covers how to find X...

SUSE CVE-2026-101900

Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class...

SUSE CVE-2026-101904

Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trust...

SUSE CVE-2026-101908

Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers...