EUVD-2026-39092

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's sendFileMessage DDP method passes the entire attacker-supplied file object into Uploads.updateFileComplete, which merges it...

Prototype Pollution

Overview simpl-schema is a schema validation package that supports direct validation of MongoDB update modifier objects. Affected versions of this package are vulnerable to Prototype Pollution. PoC const SimpleSchema = require"simpl-schema".default; let obj = ; console.log"Before : " +...

[SECURITY] [DLA 588-2] mongodb security update

Package : mongodb Version : 2.0.6-1+deb7u1 CVE ID : CVE-2016-6494 Debian Bug : 832908, 833087 This is an update of DLA-558-1. The previous build had revision number that was considered lower than the one in wheezy and was therefore not installed at upgrade. The text for DLA-558-1 is included here...