CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

UBUNTU-CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv (csv-parse) versions prior to 7.0.2 are vulnerable to a prototype replacement issue when the columns and group_columns_by_name options are enabled. In packages/csv-parse/lib/api/index.js, a duplicate __proto__ header in a CSV file is treated as an existing property, allowing an attacker-...

EUVD-2026-58728

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning...

CVE-2026-82417

A flaw was found in qs. The qs.stringify function, responsible for serializing objects, does not properly validate the isBuffer property of an object's constructor before attempting to invoke it. An unauthenticated attacker can provide specially crafted input that, when processed and then...

CVE-2026-85063: Improperly Controlled Modification of Object Prototype Attributes

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

The vulnerability of the serialization for XML documents regarding access to and manipulation of these documents, XMLDOM, allows attackers to compromise the integrity of the protected information.

The vulnerability of the serialization for XML documents related to access control and management is related to the use of regular expressions, which do not sufficiently restrict the set of allowed values. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of...

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...

CVE-2026-84292

A flaw was found in fast-uri. This component improperly serializes the port component of a Uniform Resource Identifier URI without validating its content. A remote attacker can exploit this by crafting a malicious port value that injects authority delimiters. This manipulation can demote the...

CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

DEBIAN-CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-82404

TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a proto, constructor, or prototype key wrote through the object prototype chain instead of creating an own property, polluting Object.prototype for the runtime. In...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...