134396 matches found
CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
DEBIAN-CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
UBUNTU-CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
EUVD-2026-60734
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
CVE-2026-23929 Prototype pollution leading to stored XSS
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
CVE-2026-23929
Zabbix's searchParamsToObject() function failed to filter dangerous properties like __proto__ from URL parameters, enabling prototype pollution that, combined with jQuery's unsafe element creation traversing the prototype chain, results in persistent XSS in Maps. CVSS 4.0 scores this HIGH (8.5) w...
CVE-2026-23929 Prototype pollution leading to stored XSS
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
CVE-2026-23929
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
ROOT-APP-NPM-CVE-2024-48948 CVE-2024-48948 in elliptic - Patched by Root
Root has patched CVE-2024-48948 in the elliptic package for Root:npm. Multiple fixed versions available...
Security Bulletin: Multiple Vulnerabilities in WebSphere Application Server Liberty for IBM Operations Analytics - Log Analysis
Summary Multiple vulnerabilities were addressed in WebSphere Application Server Liberty for IBM Operations Analytics - Log Analysis version 1.3.5.3 through 1.3.8.5 Vulnerability Details CVEID:CVE-2026-1561 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM...
Allocation of Resources Without Limits or Throttling
Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...
SUSE CVE-2026-19481
@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...
SUSE CVE-2026-73088
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats in node.js, reached unconditionally through getStat and loadStat on every browserslist call, processes untrusted browserslist-stats.json, opts.stats, and...
PT-2026-76956
Name of the Vulnerable Software and Affected Versions Maps affected versions not specified Description A prototype pollution issue exists in the searchParamsToObject function. The processing of URL parameters fails to filter dangerous properties such as proto . When combined with unsafe element...
CVE-2026-49226: Authorization Bypass Through User-Controlled Key
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filteradminid to...
PT-2026-80219
Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requires key: branch. When the selected export plugin advertises requires key = False, the authorization check is skipped entirely and any authenticate...
CVE-2026-23929: Improperly Controlled Modification of Object Prototype Attributes
Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like proto, combined with jQuery's unsafe element creation that traversed the prototype chain...
CVE-2026-47698
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...