scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

GHSA-2MHW-WCX5-V3XJ scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

CVE-2026-96772

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772

A security flaw in Intelliants Subrion CMS (up to version 4.2.1 ) allows for information disclosure via a remote attack. The vulnerability exists in an unspecified part of the /actions.json?action=assign-owner endpoint, where manipulating the q argument triggers the disclosure. While an exploit h...

CVE-2026-96772: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-61834

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-61834

The scim-patch library, used for applying SCIM patch operations, is vulnerable to process-global mutation in versions prior to 0.9.2 . The root cause lies in the navigate() function reading inherited properties and the assign() function using prototype-chain membership checks when resolving attac...

PT-2026-97326

Name of the Vulnerable Software and Affected Versions scim-patch versions prior to 0.9.2 Description The library fails to properly validate SCIM PATCH paths, allowing the navigate function to read inherited properties and the assign function to use prototype-chain membership checks. An attacker c...

CVE-2026-18422: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...

Astra Linux – Vulnerability in libwebp

A flaw was discovered in libwebp in versions prior to 1.0.1. An out-of-bounds read was identified in the ChunkAssignData function. The greatest threat posed by this vulnerability is related to data confidentiality and service availability...

CVE-2026-90517 PHPGurukul Bank Locker Management System view-assign-locker.php authorization

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-90517

PHPGurukul Bank Locker Management System 1.0 contains an authorization bypass vulnerability in the file /blms/view-assign-locker.php. An unauthenticated remote attacker can manipulate the ltid argument to bypass authorization controls, resulting in a partial confidentiality impact (CVSS 3.1 base ...

CVE-2026-90517 PHPGurukul Bank Locker Management System view-assign-locker.php authorization

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available a...

CVE-2026-90517: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available a...

PT-2026-90846

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available a...

ROOT-APP-NPM-CVE-2021-23329 CVE-2021-23329 in nested-object-assign - Patched by Root

Root has patched CVE-2021-23329 in the nested-object-assign package for Root:npm. Multiple fixed versions available...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: fixed the out-of-bounds error in the netns ops registration error path. If the netassigngeneric function fails, the current error path in opsinit attempts to clear the gen pointer slot. However, during this error path, the g...

CVE-2026-73305: Improper Privilege Management

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to ...