CVE-2026-97724: Improperly Controlled Modification of Object Prototype Attributes

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

PT-2026-98344

Name of the Vulnerable Software and Affected Versions Software Mansion React Native Worklets versions prior to 0.12.2 Description Prototype pollution occurs when an attacker-controlled object containing a proto property modifies the prototype of an object created during serialization within the...

GHSA-FX6F-382R-J72C CyberChef: Prototype pollution in Series Chart operation

On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation. Other operations following Series Chart could hav...

EUVD-2026-42294

CyberChef: Prototype pollution in Series Chart operation...

NPM: CyberChef: Prototype pollution in Series Chart operation

NPM: CyberChef: Prototype pollution in Series Chart operation vulnerability discovered by ? in WordPress Npm cyberchef versions 11.2.0...

CyberChef: Prototype pollution in Series Chart operation

On 5 June 2026 CyberChef received a security vulnerability report from @hyuunnn detailing a vulnerability in the Series Chart operation, where malicious input could result in prototype pollution of the data structures outputted from the operation. Other operations following Series Chart could hav...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in immutable (CVE-2026-59879, CVE-2026-59880)

Summary Multiple vulnerabilities including Prototype Pollution and memory handling flaws in the immutable persistent data structure library CVE-2026-59879, CVE-2026-59880 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 4.3.9. Vulnerability...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

Prototype Pollution

Overview mammoth is a Convert Word documents from docx to simple HTML and Markdown Affected versions of this package are vulnerable to Prototype Pollution via the readStylesXml function in lib/docx/styles-reader.js when processing a document's embedded styles. The function previously used a plain...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

The mammoth (aka mammoth.js) library before version 1.12.2 is vulnerable to prototype pollution when processing styles defined in a document. By converting a crafted .docx file, an attacker can add arbitrary properties to Object.prototype . Additionally, in versions 1.11.0 through 1.12.1 , applic...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

EUVD-2026-85782

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

CVE-2026-97151: Improperly Controlled Modification of Object Prototype Attributes

mammoth aka mammoth.js before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the...

PT-2026-97698

Name of the Vulnerable Software and Affected Versions mammoth versions prior to 1.12.2 Description The software is susceptible to prototype pollution when reading styles defined in a document. An attacker can add arbitrary properties to Object.prototype by converting a specially crafted .docx fil...

CVE-2026-77413

A flaw was found in JSONata. The lookup function, a component of the JSONata query and transformation language, did not properly validate object properties. This oversight allowed an attacker to craft malicious expressions that could access and manipulate sensitive inherited prototype members...

CVE-2026-61834

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

ROOT-APP-NPM-GHSA-H25M-26QC-WCJF GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available...

axios package vulnerabilities: CVE-2026-42043, CVE-2026-42044, CVE-2026-40175 and CVE-62718

CVE-2026-40175 Title: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Description Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution ...