CVE-2026-126570

Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.prototype by sending crafted SCIM PATCH paths to ScimServer.handleScimUsersPatch. Attackers can supply paths like proto.x or constructor.prototype.x passed to setPath to pollute...