CVE Vulnerability Catalog

In Axios from version 1.0.0 to 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values.

Axios from 1.16.1 until 1.20.0 in the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. The JavaScript regular-expression engine explores many separator placements before rejecting the URL. Excessive backtracking can block the Node.js event loop and cause denial of service.

In Axios from version 0.27.2 to 0.34.0 and 1.20.0, default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch.

Axios from 1.13.0 until 1.20.0 in Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service.

In Axios from version 1.12.0 to 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior.

Axios from 1.13.0 until 1.20.0 in HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy.

A vulnerability found in deepseek-ai deepseek-harness up to 0.1.0-rc.7 affects the run_code function of the Code Mode Sandbox component. Manipulation leads to a sandbox issue, and the attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes explicitly state the worker is "containment, not a security boundary".

A vulnerability in ag-ui-protocol ag-ui up to 2026-09-07 affects the JSON.parse function in the file legacy/convert.ts of the Middleware component. Manipulation leads to an uncaught exception, and remote exploitation is possible. Upgrading to version 2026-09-08 addresses the issue.

A flaw in ag-ui-protocol ag-ui up to 2026-09-07 affects the FilterToolCallsMiddleware function in the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the Middleware component. Executing a manipulation can lead to incomplete cleanup, and the attack may be launched remotely. Upgrading to version 2026-09-08 resolves the issue.

A vulnerability in ag-ui-protocol ag-ui up to 2026-09-23 affects an unknown part of the file SseParser.kt in the Kotlin Community SDK component. Manipulation results in handling of exceptional conditions, and the attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. When FetchHashKeyName is set to an integer (IV) or floating-point (NV) value, the string pointer is invalid, so reading the key name triggers a segmentation fault.

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first; an integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.

In kube-compare, when processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. A remote attacker can achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges.

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

XS::Parse::Infix versions 0.40 through 0.49 for Perl incorrectly treat a number as an array reference. The wrapper function uses SvRV() instead of SvROK(), failing to validate the argument type, which can lead to a segmentation fault or dereferencing an attacker-controlled address. An application processing input (e.g., from JSON) may allow an attacker to cause a crash or potentially execute code.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

In fast-mcp-telegram before version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. The URL security validation checks only the literal hostname string but never resolves DNS, allowing bypass of the denylist and fetching from loopback/private/link-local addresses. Because the fetched body is returned to the attacker as a Telegram file attachment, this is a full-read, exfiltrating SSRF.

In Network UPS Tools prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments was mis-structured, mixing code running with higher privileges (single-use token with write permissions) and untrusted inputs (PR source branch). A malicious PR from a fork could extract the GITHUB_TOKEN value, potentially allowing manipulation of repository contents, commit checks/statuses, or PR comments.