CVE-2026-54737

The CVE refers to @phun-ky/defaults-deep, a lodash-like defaultsDeep library. Before 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype (prototype pollution). Affected version ra...

CVE-2026-54737: Improperly Controlled Modification of Object Prototype Attributes

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

Crafty Syntax Image Gallery 3.1g - Remote Code Execution

!/usr/bin/perl This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This program is distributed in the hope that...

Crafty Syntax Image Gallery <= 3.1g Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This...