132279 matches found
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in IBM WebSphere Application Server Liberty
Summary Multiple vulnerabilities in IBM WebSphere Application Server Liberty that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and...
org.webjars.npm:karma-phantomjs-launcher (>=1.0.1, <=1.0.4), org.webjars.npm:phantomjs-prebuilt (2.1.16) +1 more potentially affected by CVE-2026-56876 via org.webjars.npm:extract-zip (>=1.7.0, <=2.0.1)
org.webjars.npm:extract-zip MAVEN version =1.7.0, =1.0.1, =3.3.0, =7.1.0 Source cves: CVE-2026-56876 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17660778...
Security Bulletin: Vulnerabilities in lodash, cryptography and axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.
Summary IBM Storage Defender Sentinel Anomaly Scan Engine can be affected by lodash, cryptography and axios. Vulnerabilities include allowing an attacker to perform prototype pollution, create buffer overflows, improper validation of certificates and connect to internal services. More details are...
Security Bulletin: Multiple vulnerabilities affect IBM® Db2® Big SQL on IBM Software Hub.
Summary Multiple vulnerabilities have been addressed in IBM® Db2® Big SQL on IBM Software Hub. Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION: Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465:...
CVE-2026-57926
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack...
CVE-2026-57926
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack...
CVE-2026-57926
In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack...
CVE-2026-57926
JetBrains YouTrack prior to 2026.2.16593 has a vulnerability in the websandbox bridge that enables prototype pollution. The issue affects YouTrack’s websandbox bridge component and is described as a prototype pollution attack, with the NVD noting a CVSSv3.1 base score of 9.8 (CRITICAL) under the ...
Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a prototype pollution vulnerability due to immutable (CVE-2026-29063)
Summary There is a vulnerability in the immutable library which affects IBM WebSphere Application Server Liberty with the openapi-3.0, openapi-3.1, mpOpenAPI-1.0, mpOpenAPI-1.1, mpOpenAPI-2.0, mpOpenAPI-3.0 mpOpenAPI-3.1, mpOpenAPI-4.0 or mpOpenAPI-4.1 feature enabled. Following IBM Engineering...
PT-2026-52706
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.16593 Description The websandbox bridge is susceptible to prototype pollution, a condition where an attacker can manipulate the prototype of a JavaScript object to inject properties or change the...
CVE-2026-12208
A flaw was found in the jsonata JavaScript library. A prototype pollution vulnerability exists in the createFrame function in src/jsonata.js, allowing a remote attacker to manipulate object prototype attributes. This could lead to unauthorized modification of application behavior. Mitigation Do n...
CVE-2026-55388
A flaw was found in piscina, a Node.js worker pool implementation. This vulnerability allows an attacker to achieve arbitrary code execution by exploiting a prototype pollution issue. By manipulating the filename option, an attacker can cause their malicious code to be executed within the worker,...
@browserbasehq/director-ai (1.0.2), @platformatic/pnpm-api (0.1.0) +46 more potentially affected by CVE-2026-50021 via @pnpm/lockfile.utils (>=1004.0.0, <=1004.0.3)
@pnpm/lockfile.utils NPM version =1004.0.0, =1002.0.21, =1007.0.1, =1003.0.0, =1016.1.0, =1002.3.8, =1003.0.25, =1002.0.4, =1001.2.0, =1010.1.0, =1001.0.35, =1000.2.4, =1001.0.30, =1001.0.28, =1001.0.31 and more Source cves: CVE-2026-50021 Source advisory: SNYK:JS-PNPMLOCKFILEUTILS-17661057...
GHSA-2933-Q333-QG83 i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...
EUVD-2026-37005
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string...
i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...
NPM: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string
NPM: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string vulnerability discovered by ? in WordPress Npm i18next-fs-backend versions 2.6.6...
@diia-inhouse/i18n (>=2.8.2, <=3.1.16), @genie23/electron-base (>=0.0.4-alpha, <=0.0.225) +56 more potentially affected by CVE-2026-48713 via i18next-fs-backend (>=2.0.0, <=2.6.5)
i18next-fs-backend NPM version =2.0.0, =2.8.2, =0.0.4-alpha, =3.0.0-rc.0, =7.1.2, =2.4.2, =1.1.8, =1.1.8, =2.4.2, =2.4.2, =2.6.9, =2.4.2, =2.4.2, =2.4.2, =2.4.2, =2.5.5 and more Source cves: CVE-2026-48713 Source advisory: OSV:GHSA-2933-Q333-QG83...
i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...