13 matches found
CVE-2026-91860
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
EUVD-2026-89951
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
@arcgis/core (>=5.0.0-next.108, <=5.1.0-next.52), @geoscene/charts-components (>=5.0.19, <=5.0.21) +89 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.0.0, <=25.1.11)
@vaadin/component-base NPM version =25.0.0, =5.0.0-next.108, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.13.1, =1.13.1, =1.25.0-snapshot.20260612103548 and more Source cves:...
@digital-realty/grid (1.2.4-IXUAT-11104.552907), @vaadin/hilla-react-crud (>=24.10.0, <=24.10.8) +4 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.10.0, <=24.10.4)
@vaadin/component-base NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...
CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
@digital-realty/grid (>=1.2.4-IXUAT-11104.553004, <=1.2.4), @digital-realty/ix-app-logic (>=1.2.5, <=2.1.16) +13 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.7.0, <=24.7.12)
@vaadin/component-base NPM version =24.7.0, =1.2.4-IXUAT-11104.553004, =1.2.5, =1.2.28, =1.1.33, =1.0.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =24.7.0, =24.7.0, =24.7.0, =24.7.0-rc2, =24.7.0-rc2, =24.7.15 - ui-inventory 1.0.1-IXUAT-10607.520338 - ui-launchpad 1.0.1-IXUAT-10607.520375...
@arcgis/core (>=4.34.0-next.20, <=4.34.0-next.85), @vaadin-component-factory/vcf-date-time-range-picker (1.0.0) +71 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.8.0-alpha1, <=24.9.17)
@vaadin/component-base NPM version =24.8.0-alpha1, =4.34.0-next.20, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.9.0-rc1 and more...
CVE-2026-91860
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base . The flaw occurs because the application fails to filter keys that address the prototype chain when merging user-controlled objects (e.g., parsed JSON) into chart configurations or a c...
@vaadin/hilla-react-crud (>=25.2.0, <=25.3.0-alpha2), @vaadin/react-components (>=25.2.0, <=25.2.8) +3 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.2.0, <=25.2.8)
@vaadin/component-base NPM version =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...
CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
PT-2026-103274
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...
CVE-2026-91860: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...