CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

EUVD-2026-53201

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update. Because WTForms represents an unchecked checkbox as False rather than 'unchanged', and only the 'password' field is special-cased...

SUSE CVE-2026-8997

vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file vifminfo.json. This flaw occurs because the application lacks a runtime check on the length of history entries in release builds, potentially allowing a crafted long path or command in the...

CVE-2026-71204: Improper Access Control

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CLSA-2026-1773188132 TuxCare security update for lodash.merge (2 CVEs)

TuxCare rebuilt lodash.merge to address 2 CVEs. Fixed in 3.3.2-tuxcare.2...

CVE-2026-67618

marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious baseurl in PEP-723 inline script metadata, which is merged into session configuration with higher precedence than the operator's own setting...

Exploit for CVE-2026-60004

CVE-2026-60004 — Gitea diffpatch RCE The diffpatch endpo...

Exploit for CVE-2026-3030

--- CVE-2026-3030 – Prototype Pollution in JSON Merge Patch...

PT-2026-67126

Name of the Vulnerable Software and Affected Versions Thermo Fisher Applied Biosystems Genetic Analyzers affected versions not specified Description Output files with .fsa or .hid extensions can be edited, allowing an attacker to tamper with DNA data. This could lead to inaccurate DNA test...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

Summary Jodit.configureoptions — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototy...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Impact A prototype pollution vulnerability exists in @phun-ky/defaults-deep prior to version 2.0.5. The library recursively merged user-supplied objects without filtering unsafe property names such as proto, constructor, and prototype. An attacker able to supply crafted input could cause properti...

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

GitLab 11.8 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-15975)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

CVE-2026-54737: Improperly Controlled Modification of Object Prototype Attributes

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

PT-2026-75901

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.3.0 Description When copying an instance across projects, the project restriction check AllowInstanceCreation is executed before the source instance configuration is merged into the request. This allows dangerous...

GitLab 8.8 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-14351)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

Malicious Package

Overview dash-merge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...