@browserbasehq/director-ai (1.0.2), @platformatic/pnpm-api (0.1.0) +46 more potentially affected by CVE-2026-50021 via @pnpm/lockfile.utils (>=1004.0.0, <=1004.0.3)

@pnpm/lockfile.utils NPM version =1004.0.0, =1002.0.21, =1007.0.1, =1003.0.0, =1016.1.0, =1002.3.8, =1003.0.25, =1002.0.4, =1001.2.0, =1010.1.0, =1001.0.35, =1000.2.4, =1001.0.30, =1001.0.28, =1001.0.31 and more Source cves: CVE-2026-50021 Source advisory: SNYK:JS-PNPMLOCKFILEUTILS-17661057...

GHSA-2933-Q333-QG83 i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...

EUVD-2026-37005

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string...

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...

@diia-inhouse/i18n (>=2.8.2, <=3.1.16), @genie23/electron-base (>=0.0.4-alpha, <=0.0.225) +56 more potentially affected by CVE-2026-48713 via i18next-fs-backend (>=2.0.0, <=2.6.5)

i18next-fs-backend NPM version =2.0.0, =2.8.2, =0.0.4-alpha, =3.0.0-rc.0, =7.1.2, =2.4.2, =1.1.8, =1.1.8, =2.4.2, =2.4.2, =2.6.9, =2.4.2, =2.4.2, =2.4.2, =2.4.2, =2.5.5 and more Source cves: CVE-2026-48713 Source advisory: OSV:GHSA-2933-Q333-QG83...

NPM: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

NPM: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string vulnerability discovered by ? in WordPress Npm i18next-fs-backend versions 2.6.6...

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...

EUVD-2026-37006

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names...

@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-48714 via i18next-http-middleware (>=3.0.2, <=3.9.6)

i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-48714 Source advisory: OSV:GHSA-F49M-VF83-692W...

GHSA-F49M-VF83-692W i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...

@antfu/nip (0.1.1), @condu-feature/auto-package-exports (>=1.0.0, <=1.0.3) +101 more potentially affected by CVE-2026-55697 via @pnpm/config (>=1004.0.0, <=1004.11.2)

@pnpm/config NPM version =1004.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.2, =26.2.0, =1.0.6, =0.6.19, =0.1.0-beta.0, =0.2.12 - @mirta/rollup 0.3.5 and more Source cves: CVE-2026-55697 Source advisory: SNYK:JS-PNPMCONFIG-17875561...

react-router: React Router: Remote Code Execution via prototype pollution in Framework Mode

A flaw was found in React Router when operating in Framework Mode. A remote attacker could exploit an existing prototype pollution vulnerability within the application code. This could lead to unauthorized remote code execution RCE on the server through a two-step attack involving external...

PT-2026-71986

Name of the Vulnerable Software and Affected Versions go-chi/chi versions prior to 5.3.0 Description The RealIP middleware middleware/realip.go allows IP spoofing because the realIP function reads client-controlled headers and overwrites r.RemoteAddr without verifying if the request came from a...

Security Bulletin: Multiple Vulnerabilities in Axios affect IBM Cloud Pak System

Summary Due to the use of Axios, multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1 Vulnerability Details CVEID:CVE-2026-42264 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple vulnerabilities were addressed in Watson Data Intelligence version 5.3.1. Vulnerability Details CVEID:CVE-2024-56339 DESCRIPTION: IBM WebSphere Application Server 9.0 and WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.7 could allow a remote attacker to bypass securi...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the filterToDefinedArgumentsOnly process. An attacker can inject arbitrary unvalidated arguments with the ot prefix, which are then set as environment variables and included in the template context, by...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the filterToDefinedArgumentsOnly process. An attacker can inject arbitrary unvalidated arguments with the ot prefix, which are then set as environment variables and included in the template context, by...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.0 Vulnerability Details CVEID:CVE-2026-42033 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency...

CVE-2026-54639

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of convertTokenDatatokens, output: 'object' ;; indirect usage, via using Expand API; and/or indirect...

@aios-alpha/design (>=0.2.1, <=0.3.0), @aleph-alpha/design-tokens (>=0.2.0, <=1.1.0) +142 more potentially affected by CVE-2026-54639 via style-dictionary (>=4.3.0, <=5.4.0)

style-dictionary NPM version =4.3.0, =0.2.1, =0.2.0, =1.0.0, =1.0.0, =0.1.2, =0.1.1, =0.0.12-beta.1, =0.1.1, =0.1.2 and more Source cves: CVE-2026-54639 Source advisory: SNYK:JS-STYLEDICTIONARY-17440157...