-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16022 more potentially affected by CVE-2026-42038 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42038 Source advisory: OSV:GHSA-M7PR-HJQH-92CM...

GHSA-5C9X-8GCM-MPGX Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 native http/https transport path. Oversized streamed uploads are sent fully even when the caller sets strict body limits. Details Relevant flow in lib/adapters/http.js: - 556-564: maxBodyLength check applie...

NPM: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

NPM: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 vulnerability discovered by ? in WordPress Npm axios versions = 0.31.0...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16022 more potentially affected by CVE-2026-42034 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42034 Source advisory: OSV:GHSA-5C9X-8GCM-MPGX...

Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0

Summary For stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 native http/https transport path. Oversized streamed uploads are sent fully even when the caller sets strict body limits. Details Relevant flow in lib/adapters/http.js: - 556-564: maxBodyLength check applie...

EUVD-2026-25588

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking...

Axios: Header Injection via Prototype Pollution

Summary A prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders,...

GHSA-W9J2-PVGH-6H63 Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy

Vulnerability Disclosure: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy Summary The Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses 401, 403, 500,...

GHSA-Q8QP-CVCW-X6JJ Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

Summary Five config properties in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values ...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16022 more potentially affected by CVE-2026-42040 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42040 Source advisory: OSV:GHSA-XHJH-PMCV-23JW...

Linux Distros Unpatched Vulnerability : CVE-2026-34032

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: through 2.4.66. Users are recommended ...

PT-2026-37216

Name of the Vulnerable Software and Affected Versions D-Link DI-8100 version 16.07.26A1 Description A buffer overflow occurs in the HTTP Request Handler component when manipulating the Name argument. This issue is located within the tggl asp function of the '/tggl.asp' endpoint and can be trigger...

ROS-20260505-73-0010

A vulnerability in the http.cookies library of the Python programming language interpreter CPython is related to improper encoding or escaping of output data. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality and integrity of protected information...

Apache HTTP Server 安全漏洞

Apache HTTP Server is an open-source web server developed by the Apache Foundation in the United States. This server is known for its speed, reliability, and ability to be expanded through simple APIs. Apache HTTP Server versions 2.4.66 and earlier contain security vulnerabilities. These...

Linux Distros Unpatched Vulnerability : CVE-2026-29169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock ...

PT-2026-38374

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final Description In the HttpObjectDecoder component, the software fails to strip the Content-Length header when an HTTP/1.0 request contains both Transfer-Encoding: chunked...

📄 Microsoft Windows 11 24H2 Local Privilege Escalation

Microsoft Windows 11 24H2 suffers from a local privilege escalation vulnerability. Exploit Title: Windows 11 24H2 - Local Privilege Escalation Google Dork: inurl:http.sys "Windows 11 24H2" vulnerability | intitle:"HTTP.sys" "CVE-2026-21250" "Elevation of Privilege" Date: 2026-02-27 Exploit Author...

Linux Distros Unpatched Vulnerability : CVE-2026-33523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Serve...

D-Link DI-8100 缓冲区错误漏洞

The D-Link DI-8100 is a wireless broadband router designed for small and medium-sized network environments by D-Link Corporation. The D-Link DI-8100 version 16.07.26A1 contains a buffer overflow vulnerability. This vulnerability stems from the function sprintf in the HTTP Handler component, where...

ROS-20260505-73-0013

A vulnerability in the http.cookies library of the Python programming language interpreter CPython is related to improper encoding or escaping of output data. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality and integrity of protected information...