CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment (a JavaScript date library) versions 2.29.2 through 2.30.1 are vulnerable to a path traversal via a specially crafted non-string object passed to moment.locale(). The guard assumes string input, so an object whose match() method satisfies the check while toString() returns a traversal path...

security flaw

Firefox before 1.0.5, Mozilla before 1.7.9, and Netscape 8.0.2 and 7.2 allows remote attackers to cause a denial of service access violation and crash, and possibly execute arbitrary code, by calling InstallVersion.compareTo with an object instead of a string...