129809 matches found
CVE-2026-26021
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in =2.0.1, 2.0.5. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key...
CVE-2025-70956
Summary of CVE-2025-70956 (TON TVM) : A State Pollution vulnerability exists in TON’s Virtual Machine (TVM) prior to v2025.04, in RUNVM’s VmState::run_child_vm. The code moves critical resources (libraries and logs) from the parent to a new child VM in a non-atomic fashion. If an Out-of-Gas (OOG)...
RockyLinux 9 : pcs (RLSA-2026:2452)
The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:2452 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 Tenable has extracted the preceding description block directly from the RockyLinux securi...
CVE-2025-70956
A State Pollution vulnerability was discovered in the TON Virtual Machine TVM before v2025.04. The issue exists in the RUNVM instruction logic VmState::runchildvm, which is responsible for initializing child virtual machines. The operation moves critical resources specifically libraries and log...
TON 安全漏洞
TON is a blockchain software developed under open source. Versions of TON prior to v2025.04 contained security vulnerabilities. These vulnerabilities stemmed from state pollution in the RUNVM instruction logic, which could lead to corruption of the parent virtual machine’s state...
Ubuntu 20.04 LTS / 22.04 LTS : Dottie vulnerability (USN-8041-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8041-1 advisory. Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the proto magical attribute. An attacker could...
MiracleLinux 9 : pcs-0.11.10-1.el9_7.2.ML.1 (AXSA:2026-174:02)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-174:02 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 Tenable has extracted the preceding description block directly from the MiracleLinux...
USN-8041-1: Dottie vulnerability
Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the proto magical attribute. An attacker could possibly use this issue to achieve remote code execution...
USN-8041-1 node-dottie vulnerability
Yuhan Gao and Peng Zhou discovered that Dottie was vulnerable to prototype pollution when altering the proto magical attribute. An attacker could possibly use this issue to achieve remote code execution...
Prototype Pollution
@adonisjs/bodyparser is vulnerable to a Prototype Pollution. The vulnerability is due to improper handling of multipart form-data parsing, which allows a remote attacker to manipulate object prototypes at runtime and potentially alter application behavior...
Prototype Pollution
SandboxJS is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of the isGlobal protection flag, where wrapping a host global prototype in an array strips its taint and allows sandboxed code to mutate host built-in prototypes, leading to prototype pollution and...
AlmaLinux 10 : pcs (ALSA-2026:2438)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2438 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 Tenable has extracted the preceding description block directly from the AlmaLinux securit...
openSUSE 16 Security Update : cockpit-packages (openSUSE-SU-2026:20185-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20185-1 advisory. - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257325. Tenable has extracted th...
AlmaLinux 9 : pcs (ALSA-2026:2452)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:2452 advisory. lodash: prototype pollution in .unset and .omit functions CVE-2025-13465 Tenable has extracted the preceding description block directly from the AlmaLinux security...
Prototype Pollution
Overview set-in is a set value of nested associative structure given array of keys Affected versions of this package are vulnerable to Prototype Pollution via the set-in function. An attacker can modify the prototype of built-in objects by supplying crafted input that leverages Array.prototype,...
CVE-2026-26021
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in =2.0.1, 2.0.5. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key...
CVE-2026-26021
CVE-2026-26021 affects the npm package set-in (versions >=2.0.1,
CVE-2026-26021 Prototype pollution in set-in
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in =2.0.1, 2.0.5. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key...
CVE-2026-26021 Prototype pollution in set-in
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in =2.0.1, 2.0.5. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key...
CVE-2026-26021
set-in provides the set value of nested associative structure given array of keys. A prototype pollution vulnerability exists in the the npm package set-in =2.0.1, 2.0.5. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key...