Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input during OIDC authentication flow processing. An attacker can...

Odoo Apps - Cross-Site Scripting via Prototype Pollution Detection

jquery-bbq 1.2.1 contains a prototype pollution caused by improperly controlled modification of object prototype attributes, letting malicious users inject properties into Object.prototype, exploit requires malicious user interaction. !/usr/bin/env python3 -- coding: utf-8 -- """jquery-bbq 1."""...

Lodash version 4.17.21 is affected by CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original...

CVE-2026-14893: Improperly Controlled Modification of Object Prototype Attributes

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

PT-2026-65602

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-66922: Improperly Controlled Modification of Object Prototype Attributes

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

@pmate/account-sdk (>=0.6.1, <=0.10.1), @pmate/agent-sdk (>=1.0.2, <=2.0.1) +3 more potentially affected by unknown CVE via @pmate/utils (1.1.4)

@pmate/utils NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @pmate/utils and may be impacted: - @pmate/account-sdk =0.6.1, =1.0.2, =0.1.3, =0.12.0, =0.2.0, =0.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-PMATEUTILS-18550696...

003-gas-convert (1.0.1), 108-gas-convert (1.0.0) +9558 more potentially affected by CVE-2018-1002203 +2 more via unzipper (>=0.3.0, <=0.12.5)

unzipper NPM version =0.3.0, =4.3.4, =2.0.0, =3.0.0, =2.0.0, =1.0.0, =1.0.26, =0.0.80, =1.0.0-beta.1, =0.0.1, =1.0.7, =1.3.0 and more Source cves: CVE-2018-1002203, CVE-2026-17514, CVE-2026-59972 Source advisory: SNYK:JS-UNZIPPER-18365659...

Linux Distros Unpatched Vulnerability : CVE-2026-65913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USEPROFILES mode that allows attackers to bypass attribute filtering by polluting...

Quasar: Prototype pollution in the extend() utility

Summary [email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend utility exported from the package root. When extendtrue, target, source is used for a deep merge, attacker-controlled object keys are recursively...

GHSA-3R53-75J5-3G7J Quasar: Prototype pollution in the extend() utility

Summary [email protected], the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend utility exported from the package root. When extendtrue, target, source is used for a deep merge, attacker-controlled object keys are recursively...

NPM: Quasar: Prototype pollution in the extend() utility

NPM: Quasar: Prototype pollution in the extend utility vulnerability discovered by ? in WordPress Npm quasar versions = 2.21.4...

@rse/claudex (>=0.9.22, <=1.0.10), @snyk/snyk-cocoapods-plugin (>=2.6.0, <=3.1.1) +6 more potentially affected by CVE-2026-73414 via shescape (>=2.1.0, <=2.1.12)

shescape NPM version =2.1.0, =0.9.22, =2.6.0, =2.0.0, =8.0.0, =6.0.0, =3.0.0, =3.0.0, =3.1.2 Source cves: CVE-2026-73414 Source advisory: OSV:GHSA-W4HW-QCX7-56PR...

@0xwork/connect (>=0.1.8, <=0.1.9), @actagent/fs-safe (0.3.0) +873 more potentially affected by CVE-2026-73566 via tar (>=7.0.0, <=7.5.20)

tar NPM version =7.0.0, =0.1.8, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.5.2-zh, =0.1.1, =0.1.1, =0.59.0, =2.17.11, =1.9.5, =1.0.2, =8.8.3, =8.11.4 and more Source cves: CVE-2026-73566 Source advisory: OSV:GHSA-R292-9MHP-454M...

Prototype Pollution

Overview mongoose is a Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution in the schema path getter Schema.getSchema during update casting, which follows a proto-prefixed dotted path...

NPM: Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

NPM: Mongoose: Prototype pollution in mongoose update casting via proto-prefixed dotted path Schema.getSchema/path getter vulnerability discovered by ? in WordPress Npm mongoose versions 6.13.10...

Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Impact What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOnefilter, req.body, can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: javascript...

GHSA-664H-WQGQ-64GW Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Impact What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOnefilter, req.body, can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: javascript...

@claspo/common (>=5.2.1-theme.13, <=7.5.14), @claspo/components (>=1.1.14, <=1.10.30) +3 more potentially affected by CVE-2026-73649 via velocityjs (>=2.0.6, <=2.1.6)

velocityjs NPM version =2.0.6, =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.7.1 Source cves: CVE-2026-73649 Source advisory: OSV:GHSA-7GFH-X38P-PRH3...

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Summary Remote Code Execution RCE in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq "Prototype Pollution in set path assignment" — that advisory blocked constructor/proto/prototype only in the set assignment handler set.cjs, but...