Lucene search
+L

1553 matches found

Veracode
Veracode
added 2026/04/13 12:44 p.m.8 views

Server-Side Request Forgery (SSRF)

Axios is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper hostname normalization when evaluating NOPROXY rules, where crafted loopback addresses e.g., localhost. or ::1 bypass proxy exclusions and are routed through the proxy, allowing attackers to access...

9.9CVSS5.8AI score0.01161EPSS
SaveExploits1References45Affected Software1
RedHat Linux
RedHat Linux
added 2026/04/11 7:41 p.m.3 views

cpython: cpython: `tarfile` module misinterprets crafted tar archives leading to data integrity issues

A flaw was found in the tarfile module of cpython. This vulnerability allows a remote attacker to craft a malicious tar archive that, when processed, could be misinterpreted by the tarfile module. This misinterpretation occurs because the module incorrectly applies normalization of AREGTYPE block...

3.3CVSS6.1AI score0.00164EPSS
SaveExploits0References7
OSV
OSV
added 2026/04/11 2:5 p.m.11 views

OESA-2026-1902 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

7.5CVSS5.7AI score0.00621EPSS
SaveExploits0References5
OSV
OSV
added 2026/04/11 2:5 p.m.10 views

OESA-2026-1901 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

7.5CVSS5.7AI score0.00621EPSS
SaveExploits0References5
OSV
OSV
added 2026/04/11 2:5 p.m.14 views

OESA-2026-1900 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

7.5CVSS5.7AI score0.00621EPSS
SaveExploits0References5
OSV
OSV
added 2026/04/11 2:5 p.m.7 views

OESA-2026-1899 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

7.5CVSS5.7AI score0.00621EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/04/10 10:36 p.m.7 views

CVE-2025-62718

A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not correctly handle hostname normalization when evaluating NOPROXY rules. An attacker can exploit this by crafting requests to loopback addresses e.g., localhost. or ::1 which bypass the NOPROXY...

9.9CVSS5.7AI score0.01161EPSS
SaveExploits1References9
RedhatCVE
RedhatCVE
added 2026/04/09 7:23 p.m.10 views

CVE-2026-35583

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, the configuration API endpoint /api/configuration/name validated configuration names using a blacklist approach that checked for , /, .., and trailing .. This could potentially be bypassed using URL-encoded variants,...

5.3CVSS5.9AI score0.0032EPSS
SaveExploits1References1
OSV
OSV
added 2026/04/09 5:32 p.m.6 views

GHSA-3P68-RC4W-QGX5 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force...

6.3CVSS5.7AI score0.01161EPSS
SaveExploits1References11
Github Security Blog
Github Security Blog
added 2026/04/09 5:32 p.m.14 views

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force...

9.9CVSS5.7AI score0.01161EPSS
SaveExploits1References11Affected Software1
Snyk
Snyk
added 2026/04/09 4:14 p.m.6 views

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper hostname normalization in the NOPROXY environment variable. An attacker controlling request URLs can acces...

9.9CVSS5.7AI score0.01161EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/09 4:14 p.m.5 views

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper hostname normalization in the NOPROXY environment variable. An attacker controlling reques...

9.9CVSS5.7AI score0.01161EPSS
SaveExploits1References2
NVD
NVD
added 2026/04/09 3:16 p.m.6 views

CVE-2025-62718

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go...

9.9CVSS0.01161EPSS
SaveExploits1References43
UbuntuCve
UbuntuCve
added 2026/04/09 3:16 p.m.6 views

CVE-2025-62718

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go...

9.9CVSS6.2AI score0.01161EPSS
SaveExploits1References7
CVE
CVE
added 2026/04/09 2:31 p.m.897 views

CVE-2025-62718

Axios prior to 1.15.0 has a hostname normalization flaw when evaluating NO_PROXY rules. Requests to loopback addresses (e.g., localhost with a trailing dot or IPv6 [::1]) can bypass NO_PROXY and be routed through the configured proxy. This bypass enables potential proxy circumvention and SSRF aga...

9.9CVSS5.7AI score0.01161EPSS
SaveExploits1References43Affected Software1
Vulnrichment
Vulnrichment
added 2026/04/09 2:31 p.m.3 views

CVE-2025-62718 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go...

6.3CVSS5.7AI score0.01161EPSS
SaveExploits1References9
Cvelist
Cvelist
added 2026/04/09 2:31 p.m.44 views

CVE-2025-62718 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go...

6.3CVSS0.01161EPSS
SaveExploits1References9
OSV
OSV
added 2026/04/09 2:31 p.m.6 views

CVE-2025-62718 Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NOPROXY rules. Requests to loopback addresses like localhost. with a trailing dot or ::1 IPv6 literal skip NOPROXY matching and go...

6.3CVSS6.7AI score
SaveExploits0References45
CNNVD
CNNVD
added 2026/04/09 12:0 a.m.7 views

Axios 安全漏洞

Axios is an open-source HTTP client developed by Axios. Versions of Axios prior to 1.15.0 contained a security vulnerability, which was caused by improper handling of hostname normalization. This vulnerability could lead to proxy bypassing and server-side request forge attacks...

9.9CVSS6.6AI score0.01161EPSS
SaveExploits1References9
Veracode
Veracode
added 2026/04/08 3:42 p.m.9 views

Improper Input Validation

OAuth2-Proxy is vulnerable to improper input validation. The vulnerability is due to inconsistent normalization of underscores and dashes in X-Forwarded- headers, which allows an attacker to inject crafted header variants to bypass proxy filtering and potentially escalate privileges in upstream...

8.5CVSS5.8AI score0.00633EPSS
SaveExploits0References7Affected Software2
Rows per page
Query Builder