CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-04-25 (8)

2026-04-25 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-04-25

8 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-42043 — 10.0 — Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.…
  • CVE-2026-39920 — 9.8 — BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to e…
  • CVE-2026-6951 — 9.8 — Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for CVE-2022-25912 that blocks the -c opt…
  • CVE-2026-31685 — 9.4 — In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_eui64: reject invalid MAC header for all packets eui64_mt6() derives a modified EUI-64 from the Ethernet source address and compares i…
  • CVE-2026-41677 — 9.1 — rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.0 to before 0.10.78, the *_from_pem_callback APIs did not validate the length returned by the user's callback. A password callback that r…
  • CVE-2026-42044 — 9.1 — Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the app…
  • CVE-2026-41248 — 9.1 — Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowing them to skip middl…
  • CVE-2026-31682 — 9.1 — In the Linux kernel, the following vulnerability has been resolved: bridge: br_nd_send: linearize skb before parsing ND options br_nd_send() parses neighbour discovery options from ns->opt[] and assumes that these option…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.