Deep Sea Electronics DSE855 - Authentication Bypass

Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to...

CVE-2026-73647

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-73647

The vulnerability CVE-2026-73647 affects Quasar Framework prior to version 2.22.0. The public extend() utility in ui/src/utils/extend/extend.js recursively copies attacker-controlled keys during deep merges (extend(true, target, source)) and does not reject an own proto property. This could cause...

CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-73647 Quasar Framework: Prototype pollution in Quasar extend() utility

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

EUVD-2026-58189

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

UBUNTU-CVE-2026-71438

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

GHSA-C4C3-PG64-4M4V Mermaid configuration APIs allow prototype pollution

Summary Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution. Because these APIs...

CVE-2026-71438 Mermaid configuration APIs allow prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

CVE-2026-71438 Mermaid configuration APIs allow prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig merge caller-supplied configuration into Mermaid's interna...

CVE-2026-64194

A flaw was found in Net::DNS. A remote attacker can exploit this vulnerability by sending a specially crafted DNS packet with deep compression pointer chains. This can cause excessive recursion in the Net::DNS::DomainName::decode function, leading to stack exhaustion and a Denial of Service DoS f...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

CVE-2026-18739

The CVE concerns the popt library, specifically a vulnerability in the function poptStuffArgs . An off-by-one condition occurs when the function is called repeatedly by a host application or through deep alias nesting, which can corrupt internal program data. The description states this corruptio...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

EUVD-2026-51592

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...