Prototype Pollution

Overview compromise is a natural language processing in the browser. Affected versions of this package are vulnerable to Prototype Pollution via the nlp.extend function in the Public Root API. An attacker can modify object prototype attributes by supplying a crafted plugin argument, potentially...

EUVD-2026-43743

A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remot...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2026-59197 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2026-59197 Source advisory:...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2026-59205 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2026-59205 Source advisory:...

django-leaflet-storage (0.8.0b0), heatmappy (>=0.2.0, <=0.2.6) +3 more potentially affected by CVE-2026-59199 via pillow (3.0.0)

pillow PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-leaflet-storage 0.8.0b0 - heatmappy =0.2.0, =0.1.4, =0.1.14 - swmmio 0.2.1 - wsy-captcha 1.0.0 Source cves: CVE-2026-59199 Source advisory:...

CVE-2026-15699

A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remot...

CVE-2026-15699 spencermountain compromise Public Root API extend.js nlp.extend prototype pollution

A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remot...

CVE-2026-15699

The CVE-2026-15699 entry concerns a prototype pollution vulnerability in spencermountain compromise (≤ 14.15.1) affecting the Public Root API. Specifically, the function nlp.extend in src/API/extend.js can be exploited by manipulating the plugin argument, leading to improper modification of objec...

CVE-2026-15699 spencermountain compromise Public Root API extend.js nlp.extend prototype pollution

A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remot...

cf-nlp (>=0.1.0, <=0.1.11), deepdefacer (>=0.0.2, <=1.0.4) +7 more potentially affected by CVE-2026-12482 via keras (2.2.2)

keras PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cf-nlp =0.1.0, =0.0.2, =2.0.3, =0.6.0, =0.0.23, =0.2.0 Source cves: CVE-2026-12482 Source advisory: OSV:GHSA-58HV-7753-XMFQ...

PT-2026-58088

A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component Public Root API. The manipulation of the argument plugin leads to improperly controlled modification of object prototype attributes. Remot...

benchformer (0.0.1.dev1), nerblackbox (>=0.0.5, <=0.0.10) +1 more potentially affected by CVE-2026-31221 via pytorch-lightning (0.7.1)

pytorch-lightning PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - benchformer 0.0.1.dev1 - nerblackbox =0.0.5, =0.0.10 - nlp-architect 0.5.3 Source cves: CVE-2026-31221 Source advisory:...

fact-checking (0.0.1), hc-nlp (>=0.1.0, <=0.2.0) +3 more potentially affected by CVE-2026-40171 via jupyterlab (2.2.9)

jupyterlab PYPI version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - fact-checking 0.0.1 - hc-nlp =0.1.0, =0.0.2, =0.0.5 - muvimaker 0.2.6b0 - zero-shot-re 0.0.4 Source cves: CVE-2026-40171 Source advisory:...

cf-nlp (>=0.1.0, <=0.1.11), deepdefacer (>=0.0.2, <=1.0.4) +7 more potentially affected by CVE-2026-1462 via keras (2.2.2)

keras PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cf-nlp =0.1.0, =0.0.2, =2.0.3, =0.6.0, =0.0.23, =0.2.0 Source cves: CVE-2026-1462 Source advisory: OSV:PYSEC-2026-2547...

fact-checking (0.0.1), hc-nlp (>=0.1.0, <=0.2.0) +3 more potentially affected by CVE-2024-43805 via jupyterlab (2.2.9)

jupyterlab PYPI version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - fact-checking 0.0.1 - hc-nlp =0.1.0, =0.0.2, =0.0.5 - muvimaker 0.2.6b0 - zero-shot-re 0.0.4 Source cves: CVE-2024-43805 Source advisory:...

cf-nlp (>=0.1.0, <=0.1.1), dlgo (0.2.0) +2 more potentially affected by CVE-2023-33976 via tensorflow (1.10.1)

tensorflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - cf-nlp =0.1.0, =0.6.0, =0.6.1 Source cves: CVE-2023-33976 Source advisory: OSV:PYSEC-2026-3190...

azureml-contrib-brainwave (0.1.68.2), azureml-train-automl (>=0.1.68, <=0.1.80) +5 more potentially affected by CVE-2023-33976 via tensorflow (1.10.0)

tensorflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - azureml-contrib-brainwave 0.1.68.2 - azureml-train-automl =0.1.68, =2.0.3, =0.11.9, =0.13.0a5 - scaden 0.9.0 Source cves: CVE-2023-33976...

fancy-nlp (>=0.0.1, <=0.0.4), nyoka (>=1.0.0, <=1.5.4) +3 more potentially affected by CVE-2023-33976 via tensorflow (1.9.0)

tensorflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - fancy-nlp =0.0.1, =1.0.0, =0.11.0, =0.5.4, =0.5.7 Source cves: CVE-2023-33976 Source advisory: OSV:PYSEC-2026-3190...

fact-checking (0.0.1), hc-nlp (>=0.1.0, <=0.2.0) +3 more potentially affected by CVE-2024-22421 via jupyterlab (2.2.9)

jupyterlab PYPI version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - fact-checking 0.0.1 - hc-nlp =0.1.0, =0.0.2, =0.0.5 - muvimaker 0.2.6b0 - zero-shot-re 0.0.4 Source cves: CVE-2024-22421 Source advisory:...

azureml-contrib-brainwave (0.1.68.2), azureml-train-automl (>=0.1.68, <=0.1.80) +5 more potentially affected by CVE-2023-25661 via tensorflow (1.10.0)

tensorflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - azureml-contrib-brainwave 0.1.68.2 - azureml-train-automl =0.1.68, =2.0.3, =0.11.9, =0.13.0a5 - scaden 0.9.0 Source cves: CVE-2023-25661...