CVE-2026-40190

LangSmith Client SDKs (langsmith) prior to v0.5.18 contain a prototype pollution vulnerability in the internally vendored lodash set() utility. The baseAssignValue() guard only stops proto but allows traversal via constructor.prototype, enabling an attacker who controls keys in data processed by ...

UBUNTU-CVE-2026-27837

Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit 7d3aee1 only validates the first segment of a dot-separated path, allowing an attacker to bypass the...