Astra Linux – Vulnerability in node-json-schema

JSON-schema is vulnerable to improperly controlled modification of object prototype attributes known as “Prototype Pollution”...

Astra Linux – Vulnerability in node-ini

This affects the package ini before version 1.3.6. If an attacker submits a malicious INI file to an application that parses it using ini.parse, they will corrupt the prototype within the application. This can be further exploited depending on the context...

Astra Linux – Vulnerability in Firefox and Thunderbird

An attacker could have sent a message to the parent process, with the contents being used to index into a JavaScript object twice. This would lead to prototype pollution, and ultimately, attacker-controlled JavaScript would execute in the privileged parent process. This vulnerability affects...

Astra Linux – Vulnerability in node-y18n

The package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution...

Astra Linux – Vulnerability in dojo

All versions of the dojo package are vulnerable to Prototype Pollution through the setObject function...

CVE-2026-61534: Improperly Controlled Modification of Object Prototype Attributes

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-55451: Improperly Controlled Modification of Object Prototype Attributes

gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without...

CVE-2026-55091: Improperly Controlled Modification of Dynamically-Determined Object Attributes

flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses attacker-influenced id and parent record fields directly as keys in the plain temp and pendingChildOf objects. When parent or id is proto,...

Linux Distros Unpatched Vulnerability : CVE-2026-90771

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code...

Malicious code in joko-esdoger11-sukiwir (npm)

Source: amazon-inspector 37b72c34a87dc61d835f49ad918891f08c3b494c4a3f1c88d8eeacaa96b7ce1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-bakso68-riris (npm)

Source: amazon-inspector 7f7c8c2bf4ee4d90ed63ec58a21002f38e6b9487dbc2ff95a4b9b620034a61b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jeep-poke10 (npm)

Source: amazon-inspector 2a6efdb4aa65c86e7f336b64317b7c1534fd6718150c7bcff0b6369829fd31d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jaja-brongkos6-sluey (npm)

Source: amazon-inspector 92057b200a69e29c26932cbcaf8354ac4aae1769547f89566e6a5b28ebc544e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in iwan-rujak41-breki (npm)

Source: amazon-inspector 9816b2673853ce87b13788b9d0d54f40717ff70804a93011d0bd94c835579717 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in iwan-liwet32-sukiwir (npm)

Source: amazon-inspector 403cd3cbb37ca16dd7d7d9738d2e846b0388e0f85369c40d34e68c7e60bcef73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in irma-rangi21-miaww (npm)

Source: amazon-inspector c68593b7e5b7d8d651b2125705b2ff240a8de14e503a48b3b52ca9079ebff7fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in irma-rangginang78-miaww (npm)

Source: amazon-inspector f09a4ee99a6cb0732cd3f177e2456fc06f5b1e6cb9ca23218b0f6fa20eefba7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in iqbal-poke27 (npm)

Source: amazon-inspector 3117716a1ab61b551637f13a4f15928c8aca42d5592209379d4388e6838e94f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in iota-stub-wind-quick-promise (npm)

Source: amazon-inspector 926d033f3f79f78ed2711cf99d51fef9eae637b5fe355e222fd485b6b583a03d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in intan-68 (npm)

Source: amazon-inspector 838d05bd2206a1db10ddff3753181f982e5b896026fd487e0da153d4ec23b088 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...