Nssys

**Name of the Vulnerable Software and Affected Versions** Node.js versions 22.x Node.js versions 24.x Node.js versions 26.0.0 through 26.3.0 **Description** An issue in proxy tunnel error handling may lead to the exposure of proxy credentials within `ERR PROXY TUNNEL` error messages. This occurs when credentials are embedded in the proxy URL, allowing them to be captured by logs, diagnostics, or other error consumers through specific error handling paths. **Recommendations** Update Node.js 22.x to the latest security release. Update Node.js 24.x to the latest security release. Update Node.js 26.x to version 26.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** pyLoad (affected versions not specified) **Description** An authenticated attacker with administrative privileges can achieve account takeover by stealing session files of other users. The issue arises because the software fails to block the `storage folder` variable from being set to the Flask session directory, typically located at '/tmp/pyLoad/flask'. By setting the `storage folder` to this path, an attacker can use the '/files/get/' endpoint to download session files, allowing them to impersonate other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.