EUVD-2026-95147

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

CVE-2026-107701 dot-access through 1.0.0 Prototype Pollution via set() path argument

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

CVE-2026-107384 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-107384

MariaDB Connector/Node.js versions 3.2.0 through 3.2.5, 3.3.4, 3.4.7, and 3.5.4 are vulnerable to SQL injection when the permitSetMultiParamEntries option is enabled. The root cause is that object keys expanded into a SQL SET clause are not processed by escapeId. An attacker can provide a key con...

CVE-2026-107384 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-107384 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

Protection Mechanism Failure

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Protection Mechanism Failure due to improper handling of the scheme when processing Set-Cookie headers. An attacker can overwrite, plant, or...

AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

Impact The cookie store ignores the scheme a Set-Cookie arrived on. draft-ietf-httpbis-rfc6265bis-22 approved to obsolete RFC 6265, in the RFC Editor queue Section 5.7 requires a user agent to ignore a cookie with the Secure attribute unless it arrived over a secure connection step 13, and to...

CLEANSTART-2026-VO74481 undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header

CVE-2026-84933 affects multiple packages. undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. See references for individual vulnerability details...

CVE-2026-107353

traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...

CVE-2026-107701: Improperly Controlled Modification of Object Prototype Attributes

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set. Attackers controlling the path, such as through user-supplied field names, can use proto segments to inject properties into all objects...

UBUNTU-CVE-2026-107353

traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...

PT-2026-108154

Name of the Vulnerable Software and Affected Versions dot-access versions prior to 1.0.1 Description A prototype pollution issue exists where attackers can modify Object.prototype by providing a specially crafted dotted path to the set function. By controlling the path, such as through...

Linux Distros Unpatched Vulnerability : CVE-2026-107353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the pa...

CVE-2026-107384: Improper Neutralization of Special Elements used in an SQL Command

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-97716

CVE-2026-97716 is a vulnerability in the connection set up sub-system of Secure Access servers prior to version 14.60. Unauthenticated attackers can send specially crafted traffic to the server and cause a persistent denial of service...

AZL-107078 CVE-2026-107353 affecting package js-jquery 3.5.0-4

traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...

DEBIAN-CVE-2026-107353

traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...

CVE-2026-107353

traverse npm versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution through set. When the path passed to set crosses a primitive value, the next path segment is resolved on that primitive's built-in prototype, so an application...