CVE-2026-48170 scimPatch vulnerable to prototype pollution via unfiltered keys in patch

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170

The CVE-2026-48170 issue affects the scim-patch library (SCIM PATCH processing). Before version 0.9.1, PATCH operations with a value object containing keys like proto .someProp can pollute Object.prototype, affecting all plain objects in the Node process. This can enable prototype pollution with ...

EUVD-2026-54686

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170 scimPatch vulnerable to prototype pollution via unfiltered keys in patch

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

CVE-2026-48170 scimPatch vulnerable to prototype pollution via unfiltered keys in patch

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

@aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3), @abyedev/hono-dotenv (1.0.0) +1053 more potentially affected by CVE-2026-71850 via hono (>=3.8.4, <=4.12.33)

hono NPM version =3.8.4, =0.1.0, =0.3.1, =5.0.0, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.9, =0.1.12 and more Source cves: CVE-2026-71850 Source advisory: SNYK:JS-HONO-18592332...

SUSE CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

SUSE CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

Injection js-cookie Dependency in Bamboo Data Center

This High severity Injection vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N allows an unauthenticated attack...

Security Bulletin: IBM WebSphere eXtreme Scale is affected by multiple CVEs

Summary Multiple vulnerabilities were addressed in IBM WebSphere eXtreme Scale ifix PH72363 Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION: Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465:...

Security Bulletin:Axios Prototype Pollution Vulnerability Fixed in Version 1.15.2

Summary Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser in the HTTP adapter are read via direct property access without hasOwnProperty guards,...

Security Bulletin:Axios Prototype Pollution: Intercept JSON Responses or Hijack HTTP Transport

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before...

Security Bulletin:Axios Prototype Pollution Vulnerability: Object.prototype Pollution Leading to Privilege Escalation and Authorization Bypass in Axios Library Prior to 1.15.2

Summary Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible...

Node.js Module axios 1.15.2 < 1.18.0 Prototype Pollution (CVE-2026-67314)

The version of the axios Node.js module installed on the remote host is 1.15.2 prior to 1.18.0. It is, therefore, affected by a vulnerability: - Prototype-pollution read-side gadgets in Basic auth subfield handling. When an application is already affected by a separate prototype-pollution primiti...

CVE-2026-48170: Improperly Controlled Modification of Object Prototype Attributes

scim-patch, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose value object contains a key like "proto.someProp". After one such patch, Object.prototype.someProp is set process-wide, affecting every plain object in the...

Linux Distros Unpatched Vulnerability : CVE-2026-71437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture...

Linux Distros Unpatched Vulnerability : CVE-2026-71438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration...

Node.js Module axios < 0.33.0 / 1.x < 1.18.0 Prototype Pollution

The version of the axios Node.js module installed on the remote host is prior to 0.33.0 or 1.x prior to 1.18.0. It is, therefore, affected by multiple vulnerabilities: - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has...

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...