Security advisories

high2026-09-30

CVE-2026-91777-jackson-databind quadratic forward-reference completion

View chart →

fasterxml/jackson-databind · GHSA-cxp5-3px4-pw24

high2026-09-30

CVE-2026-91776-jackson-databind retains every unknown raw type ID

View chart →

fasterxml/jackson-databind · GHSA-wv8q-qhhj-9h54

medium2026-09-30

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal

View chart →

thephpleague/commonmark · GHSA-97jj-33gv-5xf9

high2026-09-30

league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan

View chart →

thephpleague/commonmark · GHSA-3q6v-r5mr-hxv8

high2026-09-30

CVE-2026-101916-@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized

View chart →

grpc/grpc-node · GHSA-m9gg-hp2v-232j

low2026-09-30

CVE-2026-101915-@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

View chart →

grpc/grpc-node · GHSA-f596-whhp-79r4

medium2026-09-30

CVE-2026-101904-Axios: Header Injection via Inherited headers After Minimal Interceptor

View chart →

axios/axios · GHSA-j8rh-479h-cp32

medium2026-09-30

CVE-2026-101900-Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders

View chart →

axios/axios · GHSA-4hqw-qxg8-jxx2

high2026-09-30

CVE-2026-101905-Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection

View chart →

axios/axios · GHSA-m8m8-qj5v-23w3

medium2026-09-30

CVE-2026-101899-Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges

View chart →

axios/axios · GHSA-44g4-m2mj-wpvx

high2026-09-30

CVE-2026-101907-Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF

View chart →

axios/axios · GHSA-r4gj-5m52-g5wh

medium2026-09-30

CVE-2026-101908-Axios: Prototype pollution gadget in fetch adapter can alter outbound requests

View chart →

axios/axios · GHSA-vh66-26gq-q6x8

medium2026-09-30

CVE-2026-101902-Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method

View chart →

axios/axios · GHSA-9fr6-4gfg-395g

high2026-09-30

CVE-2026-101903-Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

View chart →

axios/axios · GHSA-c29m-xwm3-cm6r

high2026-09-30

CVE-2026-101906-Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

View chart →

axios/axios · GHSA-mghh-pgcx-3jjj

high2026-09-30

CVE-2026-101909-Axios: Prototype Pollution Gadget in axios toFormData Options

View chart →

axios/axios · GHSA-x97p-jq2g-jp4f

high2026-09-30

CVE-2026-101898-Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls

View chart →

axios/axios · GHSA-3pq3-5fj3-cg6v

high2026-09-30

CVE-2026-101901-Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

View chart →

axios/axios · GHSA-542g-h47m-68v8

medium2026-09-30

CVE-2026-97688-urllib3: Chunked Deflate streaming can enter an infinite loop

View chart →

urllib3/urllib3 · GHSA-gh4c-6fx4-qh6g

critical2026-09-30

Next.js: Remote Code Execution in next/og ImageResponse

View chart →

vercel/next.js · GHSA-vcvr-r3jv-pc5j