Astro - Broken Access Control

Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. id: CVE-2025-64525...

K000163236: Node.js vulnerability CVE-2021-3918

Security Advisory Description json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' CVE-2021-3918 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product Development has...

Adobe Reader < 26.002.21901 Multiple Vulnerabilities (APSB26-141) (macOS)

The version of Adobe Reader installed on the remote macOS host is a version prior to 26.002.21901. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability that...

Adobe Acrobat < 24.001.30429 / 26.002.21901 Multiple Vulnerabilities (APSB26-141)

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 24.001.30429 or 26.002.21901. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

Linux Distros Unpatched Vulnerability : CVE-2026-63376

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse in lib/compiler.js can be tricked by a table path such as a.b.y.proto.proto,...

Adobe Reader < 26.002.21901 Multiple Vulnerabilities (APSB26-141)

The version of Adobe Reader installed on the remote Windows host is a version prior to 26.002.21901. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability tha...

Adobe Acrobat < 24.001.30429 / 26.002.21901 Multiple Vulnerabilities (APSB26-141) (macOS)

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 24.001.30429 or 26.002.21901. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution'...

PT-2026-88493

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...

CVE-2026-81994: Improperly Controlled Modification of Object Prototype Attributes

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...

CVE-2026-86078: Improperly Controlled Modification of Object Prototype Attributes

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain proto or constructor, causing nested writes t...

PT-2026-88509

Impact The Instance AI workflow summary built its result with get-or-create-then-nested-write idioms keyed by node names and connection keys taken from the stored workflow. Those are arbitrary strings: the restricted-name guard n8n shows in the editor is client-side and is bypassed by posting the...

CVE-2026-82755

Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data Vulnerability Details CVEID:CVE-2026-48713 DESCRIPTION: Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation...

Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance

Summary Vulnerabilities identified in cyclops of IBM Netezza Software have been addressed in version 11.3.1.4. Vulnerability Details CVEID:CVE-2026-73088 DESCRIPTION: Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7,...

Malicious code in dynamic_fly_z3n (npm)

Source: amazon-inspector c5131621ed96dad8cfe9df944285b8efb8d13089282704f7ffd8fe7c4d7fc2fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dying_shrimp_z3n (npm)

Source: amazon-inspector c827781b3609436b27d29d306741bd52db2fe59758fef8d512e7585f455f8e5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dusty_barnacle_z3n (npm)

Source: amazon-inspector 8cf4b299aa22257d273a0f9e313a475cc20c502c5220db06d52c4477fda3d043 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dorado-module-centauri-procyon (npm)

Source: amazon-inspector 9dc48c5da0d6de22d1a878291edfa6b66e1ba73e9a36bab77ba8939963d3e8cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in disabled_bobcat_z3n (npm)

Source: amazon-inspector d197b35fb93942edc69fe7421a2d52cadfda345245a3b7d318a65d7e5c25b481 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in disabled_wildcat_z3n (npm)

Source: amazon-inspector f6494ee5ebe01d11dba13fadd4dfdb2f8730798555521cfcf8a2a4ed42888bd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...