Mittel43 / 100Konfidenz: Mittel

CVSS9.9EPSS3 %Über Netz erreichbarOhne AnmeldungOhne Zutun des Nutzers

Alle betroffenen Atlassian-Produkte müssen umgehend auf die neuesten, von Atlassian bereitgestellten Sicherheitsupdates aktualisiert werden.

▸Herleitung der Bewertung(5)

Wie der Wert zustande kommt

Hoechster CVSS-Basiswert 9.9+18
Ohne Anmeldung ueber das Netz ausnutzbar (CVE-2025-14813, CVSS-Vektor AV:N/PR:N)+10
Belegte Wirkungstaktik: collection+8
Belegte Angriffskette ueber 3 Kill-Chain-Phasen+6
EPSS 8.8 % Ausnutzungswahrscheinlichkeit binnen 30 Tagen+1

Woraus sich die Konfidenz ergibt

Nur ein Herausgeber — keine Gegenlesung
Darunter eine behoerdliche Primaerquelle
Strukturierte CVE-Daten aus der NVD vorhanden

Die Konfidenz misst die Belegqualität, nicht die Schwere.

Einschränkungen

19 im Text genannte CVE(s) liegen uns nicht vor und gehen nicht in die Bewertung ein: CVE-2016-10540, CVE-2020-28282, CVE-2020-7729, CVE-2021-22569, CVE-2021-23358, CVE-2022-1537, CVE-2022-3509, CVE-2022-3510, CVE-2022-37599, CVE-2022-37601, CVE-2022-37603, CVE-2024-7254, CVE-2026-22731, CVE-2026-29145, CVE-2026-31802, CVE-2026-33671, CVE-2026-34043, CVE-2026-42035, CVE-2026-44490
Fuer 1 erkannte CVE(s) liegt noch kein CVSS-Basiswert vor (NVD-Rueckstau).

Bewertung v1.1, deterministisch berechnet. Bedrohungswert und Konfidenz sind getrennte Größen.· 2026-08-10 11:51 UTCMethodik

Red Team

[UPDATE] [hoch] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen

CERT-Bund·10. August 2026, 11:51

Originalartikel lesen bei CERT-Bund

Mehrere Atlassian-Produkte, darunter Bamboo, Bitbucket und Jira, weisen kritische Schwachstellen auf. Angreifer könnten diese nutzen, um Code auszuführen, Daten zu manipulieren oder vertrauliche Informationen preiszugeben. Nutzer dieser Software sind dringend aufgerufen, die bereitgestellten Sicherheitsupdates zu installieren, um sich vor potenziellen Angriffen zu schützen.

SecBoard-Einordnung

Das Vorhandensein kritischer Schwachstellen in weit verbreiteten Entwicklungstools und Kollaborationsplattformen stellt ein hohes Risiko dar. Eine erfolgreiche Ausnutzung könnte die Integrität von Code-Repositories, Projektmanagement-Daten und sensiblen Unternehmensinformationen gefährden.

Realistisch schlimmster Fall: Angreifer könnten die Kontrolle über Atlassian-Instanzen erlangen, beliebigen Code ausführen, Daten manipulieren, vertrauliche Informationen exfiltrieren oder Dienste unterbrechen. Dies könnte zu einem erheblichen Betriebsstillstand und Datenverlust führen.

Im erfassten Bestand

▸CVE-2026-29146 kommt damit in 4 erfassten Meldungen der letzten 90 Tage vor.

Gezählt im eigenen Bestand, rückwärts ab dem Erscheinungsdatum. Das ist Belegstärke, keine Aussage über die Häufigkeit in der Welt.

Key Facts· 12 / 67

Nach Dringlichkeit sortiert: KEV-Eintrag, dann CVSS, dann EPSS. Vollstaendige Liste im Meldungstext.

CVE-2025-62718

CVSS: 9.9 · CRITICAL
EPSS: 1.2%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: unbekannt
Zuweisende CNA: security-advisories@github.com

CVE-2026-29063

CVSS: 9.8 · CRITICAL
EPSS: 1.0%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: unbekannt
Zuweisende CNA: security-advisories@github.com

CVE-2026-45505

CVSS: 8.8 · HIGH
EPSS: 0.6%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 5.19.7

CVE-2026-44494

CVSS: 8.7 · HIGH
EPSS: 1.0%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: hoch
Beeinträchtigt: Vertraulichkeit, Integrität
Patch: 1.16.0
Zuweisende CNA: security-advisories@github.com

CVE-2026-35554

CVSS: 8.7 · HIGH
EPSS: 0.4%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: hoch
Beeinträchtigt: Vertraulichkeit, Integrität
Patch: unbekannt
Zuweisende CNA: security@apache.org

CVE-2026-44492

CVSS: 8.6 · HIGH
EPSS: 0.9%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit
Patch: 0.32.0
Zuweisende CNA: security-advisories@github.com

CVE-2026-44705

CVSS: 8.2 · HIGH
EPSS: 0.4%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Integrität, Verfügbarkeit
Patch: 0.2.6

CVE-2026-4800

CVSS: 8.1 · HIGH
EPSS: 2.8%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: hoch
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: unbekannt

CVE-2026-44249

CVSS: 8.1 · HIGH
EPSS: 1.0%
Über das Netz: ja
Anmeldung nötig: nein
Nutzerinteraktion nötig: nein
Angriffskomplexität: hoch
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: 4.2.15.Final
Zuweisende CNA: security-advisories@github.com

CVE-2026-42588

CVSS: 8.1 · HIGH
EPSS: 0.7%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität
Patch: 5.19.7

CVE-2026-27830

CVSS: 8.0 · HIGH
EPSS: 0.5%
Über das Netz: nein
Anmeldung nötig: ja
Nutzerinteraktion nötig: nein
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: unbekannt
Zuweisende CNA: security-advisories@github.com

CVE-2026-21575

CVSS: 8.0 · HIGH
EPSS: 0.3%
Über das Netz: ja
Anmeldung nötig: ja
Nutzerinteraktion nötig: ja
Angriffskomplexität: niedrig
Beeinträchtigt: Vertraulichkeit, Integrität, Verfügbarkeit
Patch: unbekannt
Zuweisende CNA: security@atlassian.com

Betroffen

Organisationen, die Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira oder Jira Service Management einsetzen.

Hersteller

ApacheAtlassianAxiosImmutable JSLodashNetty

Produkte

AxiosImmutableKafkaLodashLodash AmdLodash EsLodash.templateNettySourcetree

▸ CPE-Rohbezeichner anzeigen (10)

cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:macos:*:*
cpe:2.3:a:atlassian:sourcetree:*:*:*:*:*:windows:*:*
cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:*
cpe:2.3:a:immutable-js:immutable:*:*:*:*:*:node.js:*:*
cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:*
cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:*
cpe:2.3:a:lodash:lodash.template:*:*:*:*:*:node.js:*:*
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

Prüfen

▸Überprüfen Sie die Versionen aller eingesetzten Atlassian-Produkte (Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira, Jira Service Management) und vergleichen Sie diese mit den von Atlassian veröffentlichten sicheren Versionen.
▸Stellen Sie sicher, dass der Patch-Management-Prozess für Atlassian-Produkte aktiv ist und kritische Updates zeitnah angewendet werden.

▸ 1 weitere

▸Überprüfen Sie die Protokolle der Atlassian-Instanzen auf ungewöhnliche Aktivitäten oder Fehlermeldungen, die auf Ausnutzungsversuche hindeuten könnten.

Offene Punkte

▸ anzeigen

▸Spezifische CVE-IDs der Schwachstellen sind im Artikel nicht genannt.
▸Details zu den genauen Auswirkungen der einzelnen Schwachstellen pro Produkt sind nicht spezifiziert.
▸Informationen zu bekannten Ausnutzungen (In-the-Wild-Exploits) sind nicht im Artikel enthalten.
▸Die genauen Versionen der betroffenen Atlassian-Produkte sind nicht spezifiziert.

Red-Team-Relevanz

Was heißt das für dein nächstes Assessment?

▸ Einordnung anzeigen

Initial Access möglich?Ja
Privilege Escalation relevant?Unklar
Exploit öffentlich verfügbar?Ja
Detection / Logging prüfbar?Ja
Für Purple-Team-Szenario geeignet?Ja

Kundenfragen

Haben wir Windows extern erreichbar?
Haben wir Oracle extern erreichbar?
Können wir Reconnaissance detektieren?
Können wir Resource Development detektieren?

MITRE ATT&CK(7)

Techniken aus allen Quellen zusammengeführt — nach Stärke des Belegs sortiert.

T1059Command and Scripting Interpreterzugeordnet

„Angreifer könnten diese nutzen, um Code auszuführen“

T1490Inhibit System Recoveryzugeordnet

„Daten zu manipulieren“

T1530Data from Cloud Storagezugeordnet

„vertrauliche Informationen preiszugeben“

T1213.001Data from Information Repositories: Confluenceabgeleitet

T1583.004Acquire Infrastructure: Serverabgeleitet

T1584.004Compromise Infrastructure: Serverabgeleitet

T1592.002Gather Victim Host Information: Softwareabgeleitet

Mehrere Herkünfte bei derselben Technik heißt: mehrere unabhängige Wege führen dorthin.

Kill-Chain-Phasen

Wie weit im Ablauf die belegten Techniken liegen — je Technik die früheste Phase.

Auskundschaften

›

Bewaffnung

›

Zustellung

›

Ausnutzung

›

Einnistung

›

Fernsteuerung

›

Zielhandlung

Quellen & Belege· 1 Quelle

CERT-BundPrimärbelegPUBLICZuverlässigkeit Adiese Meldung

Behoerdliche Veroeffentlichung mit Amtspflicht zur Richtigkeit, frei zugaenglich.

Nur eine Quelle — der Sachverhalt ist an keiner zweiten Stelle gegengelesen.

Verknüpfte Intelligence

Dieselben Entitäten an anderer Stelle auf SecBoard.

Themen

hoch

Vollständigen Artikel lesen bei CERT-Bund

Erwähnte CVEs (12)

CVE-2025-62718CRITICAL(9.9)

EPSS 1.2%

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Details NVD

CVE-2026-29063CRITICAL(9.8)

EPSS 1.0%

Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.

Details NVD

CVE-2026-45505HIGH(8.8)

EPSS 0.6%

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Non-parenthesized discovery wrappers such as `masterslave:vm://...,...` and `static:vm://...` incorrectly pass validation allowing bypass of fix in CVE-2026-34197. Original description from CVE-2026-34197. Apache ActiveMQ exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String) and BrokerService.addConnector(String). An authenticated attacker can invoke these operations with a crafted discovery UR that triggers the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Details NVD

CVE-2026-44494HIGH(8.7)

EPSS 1.0%

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.

Details NVD

CVE-2026-35554HIGH(8.7)

EPSS 0.4%

A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics. When a produce batch expires due to delivery.timeout.ms while a network request containing that batch is still in flight, the batch’s ByteBuffer is prematurely deallocated and returned to the buffer pool. If a subsequent producer batch—potentially destined for a different topic—reuses this freed buffer before the original network request completes, the buffer contents may become corrupted. This can result in messages being delivered to unintended topics without any error being reported to the producer. Data Confidentiality: Messages intended for one topic may be delivered to a different topic, potentially exposing sensitive data to consumers who have access to the destination topic but not the intended source topic. Data Integrity: Consumers on the receiving topic may encounter unexpected or incompatible messages, leading to deserialization failures, processing errors, and corrupted downstream data. This issue affects Apache Kafka versions ≤ 3.9.1, ≤ 4.0.1, and ≤ 4.1.1. Kafka users are advised to upgrade to 3.9.2, 4.0.2, 4.1.2, 4.2.0, or later to address this vulnerability.

Details NVD

CVE-2026-44492HIGH(8.6)

EPSS 0.9%

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.

Details NVD

CVE-2026-44705HIGH(8.2)

EPSS 0.4%

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the configured temporary base directory at attacker-controlled locations with the privileges of the running process. This vulnerability affects applications that pass user-controlled data to tmp's file/directory creation functions without proper input sanitization. This vulnerability is fixed in 0.2.6.

Details NVD

CVE-2026-4800HIGH(8.1)

EPSS 2.8%

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). Patches: Users should upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

Details NVD

CVE-2026-44249HIGH(8.1)

EPSS 1.0%

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Details NVD

CVE-2026-42588HIGH(8.1)

EPSS 0.7%

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String). An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport's brokerConfig parameter using the "masterslave:// " URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6. Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.

Details NVD

CVE-2026-27830HIGH(8.0)

EPSS 0.5%

c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances. Several c3p0 `ConnectionPoolDataSource` implementations have a property called `userOverridesAsString` which conceptually represents a `Map<String,Map<String,String>>`. Prior to v0.12.0, that property was maintained as a hex-encoded serialized object. Any attacker able to reset this property, on an existing `ConnectionPoolDataSource` or via maliciously crafted serialized objects or `javax.naming.Reference` instances could be tailored execute unexpected code on the application's `CLASSPATH`. The danger of this vulnerability was strongly magnified by vulnerabilities in c3p0's main dependency, mchange-commons-java. This library includes code that mirrors early implementations of JNDI functionality, including ungated support for remote `factoryClassLocation` values. Attackers could set c3p0's `userOverridesAsString` hex-encoded serialized objects that include objects "indirectly serialized" via JNDI references. Deserialization of those objects and dereferencing of the embedded `javax.naming.Reference` objects could provoke download and execution of malicious code from a remote `factoryClassLocation`. Although hazard presented by c3p0's vulnerabilites are exarcerbated by vulnerabilities in mchange-commons-java, use of Java-serialized-object hex as the format for a writable Java-Bean property, of objects that may be exposed across JNDI interfaces, represents a serious independent fragility. The `userOverridesAsString` property of c3p0 `ConnectionPoolDataSource` classes has been reimplemented to use a safe CSV-based format, rather than rely upon potentially dangerous Java object deserialization. c3p0-0.12.0+ and above depend upon mchange-commons-java 0.4.0+, which gates support for remote `factoryClassLocation` values by configuration parameters that default to restrictive values. c3p0 additionally enforces the new mchange-commons-java `com.mchange.v2.naming.nameGuardClassName` to prevent injection of unexpected, potentially remote JNDI names. There is no supported workaround for versions of c3p0 prior to 0.12.0.

Details NVD

CVE-2026-21575HIGH(8.0)

EPSS 0.3%

This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.11 of Sourcetree for Mac and Sourcetree for Windows. This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires user interaction. Atlassian recommends that Sourcetree for Mac and Sourcetree for Windows customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Sourcetree for Mac and Sourcetree for Windows 3.4: Upgrade to a release greater than or equal to 3.4.13 See the release notes (https://www.sourcetreeapp.com/download-archives). You can download the latest version of Sourcetree for Mac and Sourcetree for Windows from the download center (https://www.sourcetreeapp.com/download-archives). This vulnerability was reported via our Bug Bounty program.

Details NVD

GitHub Advisories (33)

GHSA-574f-3g2m-x479· CVE-2025-14813

org.bouncycastle:bcprov-jdk14

Bouncy Castle for Java GOST 28147 CTR mode reuses keystream after 255 blocks

GHSA-hmw2-7cc7-3qxx· CVE-2026-12143

form-data

form-data: CRLF injection in form-data via unescaped multipart field names and filenames

GHSA-355h-qmc2-wpwf· CVE-2026-2332

org.eclipse.jetty:jetty-http

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

GHSA-95jq-rwvf-vjx4· CVE-2026-29145

org.apache.tomcat:tomcat

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

GHSA-qj8w-gfj5-8c6v· CVE-2026-34043

serialize-javascript

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

GHSA-fvcv-3m26-pcqx· CVE-2026-40175

axios

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

GHSA-q8qp-cvcw-x6jj· CVE-2026-42264

axios

Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking

GHSA-xxqh-mfjm-7mv9· CVE-2026-42581

io.netty:netty-codec-http

Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

GHSA-mj4r-2hfc-f8p6· CVE-2026-42583

io.netty:netty-codec-compression

Netty Lz4FrameDecoder is vulnerable to resource exhaustion

GHSA-38f8-5428-x5cv· CVE-2026-42585

io.netty:netty-codec-http

Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding

GHSA-f6hv-jmp6-3vwv· CVE-2026-42587

io.netty:netty-codec-http

Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS

GHSA-hg6c-8mvr-jqc9· CVE-2026-42588

org.apache.activemq:activemq-broker

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

GHSA-3qp7-7mw8-wx86· CVE-2026-44249

io.netty:netty-handler

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

GHSA-j5f8-grm9-p9fc· CVE-2026-44486

axios

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

GHSA-p92q-9vqr-4j8v· CVE-2026-44487

axios

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

GHSA-777c-7fjr-54vf· CVE-2026-44488

axios

Allocation of Resources Without Limits or Throttling in Axios

GHSA-898c-q2cr-xwhg· CVE-2026-44490

axios

axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions

GHSA-pjwm-pj3p-43mv· CVE-2026-44492

axios

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

GHSA-35jp-ww65-95wh· CVE-2026-44494

axios

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

GHSA-3g43-6gmg-66jw· CVE-2026-44495

axios

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

GHSA-hfxv-24rg-xrqf· CVE-2026-44496

axios

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

GHSA-ph9p-34f9-6g65· CVE-2026-44705

tmp

tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

GHSA-x4gw-5cx5-pgmh· CVE-2026-45416

io.netty:netty-handler

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

GHSA-v853-w46p-fv2h· CVE-2026-45505

org.apache.activemq:activemq-broker

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue

GHSA-58qx-3vcg-4xpx· CVE-2026-45736

ws: Uninitialized memory disclosure

GHSA-qjx8-664m-686j· CVE-2026-46625

js-cookie

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

GHSA-293q-567p-wmwq· CVE-2026-47838

org.springframework.security:spring-security-web

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

GHSA-c2gf-v879-257j· CVE-2026-48043

io.netty:netty-codec-http2

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

GHSA-96hv-2xvq-fx4p· CVE-2026-48779

ws: Memory exhaustion DoS from tiny fragments and data chunks

GHSA-c653-97m9-rcg9· CVE-2026-50010

io.netty:netty-handler

Netty: Wrapping plain trust manager silently disables hostname verification

GHSA-p93r-85wp-75v3· CVE-2026-5598

org.bouncycastle:bcprov-jdk15to18

Bouncy Castle Has Covert Timing Channel Vulnerability

GHSA-q3j6-qgpj-74h6· CVE-2026-6321

fast-uri

fast-uri vulnerable to path traversal via percent-encoded dot segments

GHSA-v39h-62p7-jpjc· CVE-2026-6322

fast-uri

fast-uri vulnerable to host confusion via percent-encoded authority delimiters