134379 matches found
CVE-2026-69200 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...
CVE-2026-69200 node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...
keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...
react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode
A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...
CVE-2026-101908
creationtimestamp| type| source ---|---|--- 2026-09-16 09:02:29+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8 2026-10-01 12:01:16+00:00| seen| https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwssq5ydot2p...
SUSE CVE-2022-37601
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3...
PT-2026-94058
Name of the Vulnerable Software and Affected Versions Builder.io Gen2 SDKs versions 5.2.11 and 0.25.13 Description A prototype pollution issue exists in the unflatten helper. This occurs when the SDK processes builder.userAttributes query parameters without implementing prototype guards. An...
CVE-2026-92781: Improperly Controlled Modification of Object Prototype Attributes
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...
CVE-2026-92779: Improperly Controlled Modification of Object Prototype Attributes
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...
CVE-2026-69200: Improperly Controlled Modification of Object Prototype Attributes
node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...
PT-2026-93840
Name of the Vulnerable Software and Affected Versions node-opcua-client versions prior to 2.145.0 Description The fieldsToJson function in the packages/node-opcua-client/source/alarms and conditions/client alarm.ts file directly assigns unsanitized field names. This allows a proto .pollutedKey pa...
PT-2026-94056
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto , prototype, or constructor paths to...
PT-2026-93900
Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.8 Description The CORS plugin in the @orpc/server package, specifically within packages/server/src/plugins/cors.ts, incorrectly copies the Vary request header from the client directly into the response. The Vary...
PT-2026-93919
Name of the Vulnerable Software and Affected Versions Junrar versions prior to 7.6.1 Description An extraction root escape exists when processing crafted archive entries. The createFile function validates only the final canonical file path, but the makeFile function creates intermediate path...
CVE-2026-86071: Improper Limitation of a Pathname to a Restricted Directory
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...
SUSE CVE-2026-90771
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify
Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in dompurify Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify before 3.4.11 fails to clone the ALLOWEDATTR allowlist when setConfig is used with an uponSanitizeAttribute hook, allowing the hook to...
CVE-2026-47780
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...
joi: joi: Prototype Pollution via custom messages
A flaw was found in joi. This vulnerability, known as prototype pollution, exists in the messages compilation function. A remote attacker can exploit this by supplying specially crafted proto keys in custom messages. This allows the attacker to manipulate object properties, which could lead to...
CVE-2026-47780 free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence
free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscriptions in free5gc/udr internal/sbi/apidatarepository.go validate the ueId path value with a regular expression whose final .+ alternative accepts every...