CVE-2026-67319

A flaw was found in axios. When the JavaScript environment's Object.prototype has been previously compromised through a technique known as prototype pollution, axios can inadvertently use malicious properties from nested configuration objects. This can lead to the silent injection of unauthorized...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the backendRef filters process. An attacker can manipulate the filter context applied to requests by creating an accepted HTTPRoute that shares the same backend Service:port, potentially causing their route's...

LiteLLM SQL注入漏洞

LiteLLM is an open-source application developed by Berri AI. It allows for the use of OpenAI format calls for all LLM APIs. In versions 1.81.16 to 1.83.7 of LiteLLM, there was a SQL injection vulnerability. This vulnerability stemmed from the use of database queries during the check of the proxy...

Cross-site Scripting (XSS)

fusiondirectory is vulnerable to Cross-Site Scripting XSS attacks. The attack exists due to insufficient sanitations in the response body which allow adding unauthorized headers via the request payload...

Server side request forgery (ssrf)

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery SSRF when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server...