The vulnerability of the Picomatch library lies in the uncontrolled modification of object prototype attributes, which allows attackers to compromise data integrity.

🗓️ 08 Jul 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Picomatch has a vulnerability from uncontrolled object prototype changes that harms data integrity.

Reporter	Title	Published	Views	Family All 73
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	5 May 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-3505, CVE-2025-14813, CVE-2026-0636, CVE-2026-5598, CVE-2026-33671, CVE-2026-33672, CVE-2026-5588, CVE-2026-40175)	8 Jun 202613:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge	8 Jul 202608:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in picomatch-2.3.1.tgz	7 May 202619:16	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Picomatch (CVE-2026-33671, CVE-2026-33672)	12 May 202618:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Jun 202607:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses picomatch-2.3.1.tgz which is vulnerable to CVE-2026-33671, CVE-2026-33672.	4 May 202606:54	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in picomatch-2.3.1.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-33671)	4 May 202614:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub	2 Jul 202619:42	–	ibm

Vulners

Node

red_hat red_hat_single_sign-onMatch7

red_hat red_hat_quayMatch3

red_hat red_hat_amq_brokerMatch7

red_hat data_gridMatch8

red_hat red_hat_process_automationMatch7

red_hat red_hat_3scale_api_management_platformMatch2

red_hat red_hat_openshift_dataMatch4

red_hat red_hat_openshift_container_platformMatch4

red_hat red_hat_satelliteMatch6

red_hat red_hat_jboss_enterprise_application_platformMatch7

red_hat red_hat_build_of_optaplannerMatch8

red_hat red_hat_advanced_cluster_securityMatch4

red_hat red_hat_jboss_enterprise_application_platformMatch8

red_hat red_hat_fuseMatch7

red_hat red_hat_build_of_apicurio_registryMatch2

red_hat cryostatMatch4

red_hat streams_for_apache_kafkaMatch2

red_hat streams_for_apache_kafkaMatch3

red_hat ansible_automation_platformMatch2

red_hat migration_toolkit_for_applicationsMatch8

red_hat red_hat_enterprise_linuxMatch8

red_hat red_hat_enterprise_linuxMatch9

red_hat red_hat_enterprise_linuxMatch10

Source	Link
github	www.github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903
github	www.github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p
lk	www.lk.astralinux.ru/
access	www.access.redhat.com/security/cve/cve-2026-33672
web	www.web.nvd.nist.gov/view/vuln/detail

08 Jul 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 25

CVSS 35.3

EPSS0.0041