scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

EUVD-2026-85327

scim-patch: Mutation of Inherited Built-in Method Objects...

NPM: scim-patch: Mutation of Inherited Built-in Method Objects

NPM: scim-patch: Mutation of Inherited Built-in Method Objects vulnerability discovered by ? in WordPress Npm scim-patch versions 0.9.2...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-61834 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-61834 Source advisory: GHSA-2MHW-WCX5-V3XJ...

ROOT-APP-NPM-CVE-2023-26136 CVE-2023-26136 in tough-cookie - Patched by Root

Root has patched CVE-2023-26136 in the tough-cookie package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-8J8C-7JFH-H6HX GHSA-8j8c-7jfh-h6hx in js-yaml - Patched by Root

Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available...

Security update for the Linux Kernel (Live Patch 17 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.63 fixes various security issues: The following security issues were fixed: CVE-2026-53360: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use bsc1270303. CVE-2026-64423: ipv4: igmp: remove multicast group from hash table ...

ROOT-APP-NPM-CVE-2025-7783 CVE-2025-7783 in form-data - Patched by Root

Root has patched CVE-2025-7783 in the form-data package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-58PV-8J8X-9VJ2 GHSA-58pv-8j8x-9vj2 in jaraco.context - Patched by Root

Root has patched GHSA-58pv-8j8x-9vj2 in the jaraco.context package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-42151 CVE-2026-42151 in github.com/prometheus/prometheus - Patched by Root

Root has patched CVE-2026-42151 in the github.com/prometheus/prometheus package for Root:Go. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44582 CVE-2026-44582 in next - Patched by Root

Root has patched CVE-2026-44582 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root

Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48779 CVE-2026-48779 in ws - Patched by Root

Root has patched CVE-2026-48779 in the ws package for Root:npm. Multiple fixed versions available...

PT-2026-102309

Name of the Vulnerable Software and Affected Versions DeepSeek deepseek-harness versions prior to 0.1.7-rc.2 Description A path traversal flaw exists in the Bundle Patch Handler component. A remote attacker can manipulate the dsh.bundle.patch argument within the loadProfile function located in th...

CVE-2026-101132: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

Exploit for Improper Neutralization of Special Elements Used in a Template Engine in Craftcms Craft_Cms

CVE-2026-28695 Patch Bypass - Craft CMS Blind RCE Authenticat...

CVE-2026-100629

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100610

Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory returns UpsertHistory rows selected solely by an attacker-supplied...

CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...

CVE-2026-100629 Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH

Capgo capgo.app backend before 12.127.5 contains an authorization flaw in the PATCH /private/rolebindings/:bindingid endpoint. The handler verifies that the newly assigned role's priority rank does not exceed the caller's own rank, but — unlike the DELETE handler — it never checks the rank of the...