CWE-454
CVEs classified under CWE-454, newest first.
3 CVEsRSS
CVE-2026-101902Medium· 6.9PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vuln…
▾ Twilightaxios · axiosEPSS 0.41%via NVD
CVE-2026-68770Critical· 9.8PoC⚖ disputedsentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, wher…
sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, wher…
▾ AbyssalHugging Face · sentence-transformersEPSS 0.91%via NVD
CVE-2026-54003CriticalKirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
▾ Midnightgetkirby · getkirby/cmsEPSS 0.74%via GHSA