Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.4 MEDIUM
CVE-2026-42042 — Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` …

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict …

axios | Remote | Cross-Site Request Forgery
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
4.8 MEDIUM
CVE-2026-42041 — Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Str…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype…

axios | Remote | Misconfiguration
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
3.7 LOW
CVE-2026-42040 — Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at li…

axios | Remote | Injection
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
6.9 MEDIUM
CVE-2026-42039 — Axios: unbounded recursion in toFormData causes DoS via deeply nested request data

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as reque…

axios | Remote | Denial of Service
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
6.8 MEDIUM
CVE-2026-42038 — Axios: no_proxy bypass via IP alias allows SSRF

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests…

axios | Remote | Misconfiguration
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
5.3 MEDIUM
CVE-2026-42037 — Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataTo…

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into th…

axios | Remote | Injection
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
5.3 MEDIUM
CVE-2026-42036 — Axios: HTTP adapter streamed responses bypass maxContentLength

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength…

axios | Remote | Denial of Service
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
7.4 HIGH
CVE-2026-42035 — Axios: Header Injection via Prototype Pollution

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attac…

axios | Remote | Injection
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
5.3 MEDIUM
CVE-2026-42034 — Axios: HTTP adapter streamed uploads bypass maxBodyLength when maxRedirects: 0

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https tra…

axios | Remote | Misconfiguration
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
7.4 HIGH
CVE-2026-42033 — Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request H…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnP…

axios | Remote | Injection
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
8.3 HIGH
CVE-2026-41898 — rust-openssl: Unchecked callback-returned length in PSK and cookie generate trampolines c…

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.24 to before 0.10.78, the FFI trampolines behind SslContextBuilder::set_psk_client_callback, set_psk_server_callbac…

rust-openssl | Remote | Memory Corruption
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
8.1 HIGH
CVE-2026-41681 — rust-openssl: MdCtxRef::digest_final() writes past caller buffer with no length check

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.39 to before 0.10.78, EVP_DigestFinal() always writes EVP_MD_CTX_size(ctx) to the out buffer. If out is smaller th…

rust-openssl | Remote | Memory Corruption
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
8.7 HIGH
CVE-2026-41680 — Marked: OOM Denial of Service via Infinite Recursion in marked Tokenizer

Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) vulnerability exists in marked. By providing a specific 3-byte input sequence a tab, a vertical tab…

marked | Remote | Denial of Service
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
7.2 HIGH
CVE-2026-41678 — rust-openssl: Incorrect bounds assertion in aes key wrap

rust-openssl provides OpenSSL bindings for the Rust programming language. From to before 0.10.78, aes::unwrap_key() contains an incorrect assertion: it checks that out.len() + 8 <= in_.len(), but t…

rust-openssl | Remote | Memory Corruption
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
1.7 LOW
CVE-2026-41677 — rust-openssl: Out-of-bounds read in PEM password callback when user callback returns an o…

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A pa…

rust-openssl | Remote | Memory Corruption
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
7.2 HIGH
CVE-2026-41676 — rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSS…

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78, Deriver::derive (and PkeyCtxRef::derive) sets len = buf.len() and passes it as the in/out len…

rust-openssl | Remote | Memory Corruption
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
5.3 MEDIUM
CVE-2026-41322 — @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is ma…

@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 er…

astro | Remote | Misconfiguration
Apr 24, 2026 Apr 25, 2026
Apr 24, 2026
Apr 25, 2026
2.2 LOW
CVE-2026-41321 — @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform en…

@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transfo…

astro | Remote | Server-Side Request Forgery
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
0.6 LOW
CVE-2026-41140 — Poetry: Path traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

Poetry is a dependency manager for Python. Prior to 2.3.4, the extractall() function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python version…

poetry | Remote | Path Traversal
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
8.8 HIGH
CVE-2026-6912 — Privilege Escalation via Self-Writable Cognito Custom Attribute in AWS Ops Wheel

Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to …

aws_ops_wheel | Remote | Authorization
Apr 24, 2026 Apr 24, 2026
Apr 24, 2026
Apr 24, 2026
Showing 20 of 5914 Results