Prototype Pollution

Overview vuetify is an a Material Design component framework for Vue.js. Affected versions of this package are vulnerable to Prototype Pollution via the mergeDeep function used to merge preset options with defaults. An attacker can inject arbitrary properties into all JavaScript objects by...

CVE-2025-8083

Vuetify CVE-2025-8083 is a Prototype Pollution flaw in the Preset configuration feature via internal mergeDeep when merging malicious presets. Affected: Vuetify >=2.2.0-beta.2 and

CVE-2025-8083 Vuetify Prototype Pollution via Preset options

The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/PrototypePollutionPreventionCheatSheet.html due to the internal 'mergeDeep' utility function used to merge options with...

CVE-2025-8083 Vuetify Prototype Pollution via Preset options

The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/PrototypePollutionPreventionCheatSheet.html due to the internal 'mergeDeep' utility function used to merge options with...

PT-2025-50969

Name of the Vulnerable Software and Affected Versions Vuetify versions 2.2.0-beta.2 through 3.0.0-alpha.10 Description The Preset configuration feature of Vuetify is susceptible to Prototype Pollution due to the 'mergeDeep' utility function used for merging options with defaults. A malicious pres...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +212 more potentially affected by unknown CVE via next (>=15.2.0, <=15.2.6)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: unknown CVE Source advisory:...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55183 +1 more via react-server-dom-webpack (>=19.0.0, <=19.0.1)

react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +250 more potentially affected by CVE-2025-55183 +1 more via next (>=15.0.0, <=15.0.5)

next NPM version =15.0.0, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.4-alpha - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 - @benimaru/balon 1.1.4 - @benimaru/bantenss 1.1.4 - @benimaru/bbasi 1.1.4 -...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +35 more potentially affected by CVE-2025-64765 +1 more via astro (>=5.0.0-beta.5, <=5.16.2)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64765, CVE-2025-66202 Source advisory: SNYK:JS-ASTRO-14235580...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +35 more potentially affected by CVE-2025-66202 via astro (>=5.0.0-beta.5, <=5.15.6)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.40 and more Source cves: CVE-2025-66202 Source advisory: OSV:GHSA-WHQG-PPGF-WP8C...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Proof-of-Concept This repository contains a Pr...

@accounter/client (>=0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, <=0.0.3-alpha-20241210194047-ed4829d58a27c1aa9634b834f5d56d78ce8c68fd), @admiral.nelson/smart-catalyst (>=1.0.19, <=1.0.24) +255 more potentially affected by CVE-2025-71389 via next (>=14.3.0-canary.24, <=15.0.4-canary.39)

next NPM version =14.3.0-canary.24, =0.0.3-alpha-20241021184442-252a149a89c221b28ae459807869535922e67185, =1.0.19, =0.1.0, =0.0.4, =0.1.0, =0.1.11, =0.0.1-alpha, =0.0.1, =0.0.1, =3.0.0, =1.0.0, =1.0.30 - @benimaru/ahgas 1.1.4 - @benimaru/asduq 1.1.4 and more Source cves: CVE-2025-71389 Source...

@aandyw/ybf (>=0.1.0, <=0.1.29), @accounter/client (>=0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, <=0.0.5-alpha-20250410150030-25fea893fb3523b55c835620f6692430d5bc9bee) +211 more potentially affected by CVE-2025-71389 via next (>=15.2.0, <=15.2.5)

next NPM version =15.2.0, =0.1.0, =0.0.4-alpha-20250227014300-bbaee6f285ce9d54b581b115d444233911983665, =0.0.1-alpha, =0.1.0, =3.2.0, =0.1.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.6.0 and more Source cves: CVE-2025-71389 Source...

3llm (0.0.1), @3bitmt/3bit-sidebar-dashboard (1.1.4) +300 more potentially affected by CVE-2025-55182 +1 more via next (>=15.1.0, <=15.1.8)

next NPM version =15.1.0, =0.0.3-alpha-20241210234548-01b7322d940b7c913e95222127be2373f0f996cf, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.1, =0.1.1, =0.1.0, =0.1.22 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0-rc-6230622a1a-20240610)

react-server-dom-webpack NPM version 19.0.0-rc-6230622a1a-20240610 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245,...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +267 more potentially affected by CVE-2025-64525 via astro (>=3.0.12, <=5.15.1)

astro NPM version =3.0.12, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =1.0.0, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.1, =0.0.1, =0.1.3, =0.1.0, =0.1.1 and more Source cves: CVE-2025-64525 Source advisory: OSV:GHSA-HR2Q-HP5Q-X767...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +32 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: OSV:GHSA-W2VJ-39QV-7VH7...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +32 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: SNYK:JS-ASTRO-13961435...

Race Condition

@angular/platform-server, @angular/ssr and @nguniversal/common are vulnerable to Race Condition. The vulnerability is due to the platform injector being stored as a module-scoped global variable during server-side rendering, which allows concurrent requests to overwrite or access each other’s...

CVE-2025-62427

The Angular SSR is a server-rise rendering tool for Angular applications. The vulnerability is a Server-Side Request Forgery SSRF flaw within the URL resolution mechanism of Angular's Server-Side Rendering package @angular/ssr before 19.2.18, 20.3.6, and 21.0.0-next.8. The function createRequestU...