Lucene search
+L

132319 matches found

Positive Technologies
Positive Technologies
added 2026/05/06 12:00 a.m.30 views

PT-2026-37343

The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the createFluentCartTable function in all versions up to, and including, 5.2.6. This makes it possible for authenticated attackers, with...

4.3CVSS5.9AI score0.00248EPSS
SaveExploits0References7
vulnersOsv
vulnersOsv
added 2026/05/05 9:48 p.m.7 views

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by CVE-2026-42334 via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: CVE-2026-42334 Source advisory: SNYK:JS-MONGOOSE-16425765...

7.5CVSS5.3AI score0.00274EPSS
SaveExploits0
vulnersOsv
vulnersOsv
added 2026/05/05 8:30 p.m.4 views

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-43930 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-43930 Source advisory: SNYK:JS-PARSESERVER-16424355...

5.9CVSS5.3AI score0.00236EPSS
SaveExploits0
vulnersOsv
vulnersOsv
added 2026/05/05 6:44 p.m.3 views

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +22 more potentially affected by CVE-2026-45006 via openclaw (>=2026.3.22, <=2026.4.22)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.0.1, =0.3.0 and more Source cves: CVE-2026-45006 Source advisory: SNYK:JS-OPENCLAW-16424087...

8.8CVSS5.4AI score0.00489EPSS
SaveExploits0
vulnersOsv
vulnersOsv
added 2026/05/05 6:43 p.m.5 views

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +22 more potentially affected by CVE-2026-45004 via openclaw (>=2026.3.22, <=2026.4.22)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.0.1, =0.3.0 and more Source cves: CVE-2026-45004 Source advisory: SNYK:JS-OPENCLAW-16424092...

8.4CVSS5.4AI score0.00144EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/05/05 3:21 p.m.22 views

CVE-2026-42041

A flaw was found in Axios, a promise-based HTTP client. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to manipulate the Object.prototype.validateStatus property. By polluting this property, all HTTP error responses such as 401, 403, or 500 are silently treated as...

8.2CVSS5.8AI score0.00611EPSS
SaveExploits1References4
IBM Security Bulletins
IBM Security Bulletins
added 2026/05/05 3:14 p.m.24 views

Security Bulletin: IBM Quantum Safe Remediator is affected by multiple vulnerabilities

Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the libraries versions. Vulnerability Details CVEID:CVE-2026-33228 DESCRIPTION: flatted is a...

9.8CVSS7.7AI score0.01557EPSS
SaveExploits7Affected Software1
vulnersOsv
vulnersOsv
added 2026/05/05 1:35 p.m.3 views

@chrysb/alphaclaw (>=0.9.1-beta.0, <=0.9.5), @twsxtd/hapi-openclaw (>=0.1.0, <=0.1.8) +2 more potentially affected by CVE-2026-43572 via openclaw (>=2026.4.10, <=2026.4.12)

openclaw NPM version =2026.4.10, =0.9.1-beta.0, =0.1.0, =0.1.8 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-43572 Source advisory: SNYK:JS-OPENCLAW-16420268...

6.3CVSS5.4AI score0.00231EPSS
SaveExploits0
Veracode
Veracode
added 2026/05/05 1:24 p.m.24 views

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to direct property access of configuration fields in the HTTP adapter e.g., config.auth, config.baseURL, config.socketPath, config.beforeRedirect, config.insecureHTTPParser without hasOwnProperty checks, allowing polluted...

9.1CVSS5.8AI score0.00715EPSS
SaveExploits1References18Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/05/05 9:44 a.m.14 views

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Lodash which is vulnerable to CVE-2025-13465

Summary IBM Maximo Application Suite - Visual Inspection component uses Lodash which is vulnerable to CVE-2025-13465, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 a...

8.2CVSS7.1AI score0.01627EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/05/05 8:35 a.m.10 views

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses lodash-4.17.23.tgz which is vulnerable to CVE-2026-2950, CVE-2026-4800

Summary IBM Maximo Application Suite - Visual Inspection component uses lodash-4.17.23.tgz which is vulnerable to CVE-2026-2950, CVE-2026-4800, This bulletin contains information regarding the vulnerability and its remediation. Vulnerability Details CVEID:CVE-2026-2950 DESCRIPTION: Impact: Lodash...

9.8CVSS7.3AI score0.02759EPSS
SaveExploits0Affected Software1
vulnersOsv
vulnersOsv
added 2026/05/05 12:40 a.m.5 views

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16000 more potentially affected by CVE-2026-42037 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42037 Source advisory: OSV:GHSA-445Q-VR5W-6Q77...

5.3CVSS6AI score0.00294EPSS
SaveExploits1
OSV
OSV
added 2026/05/05 12:26 a.m.15 views

GHSA-PF86-5X62-JRWF Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Summary When Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before the application sees it, or b fully hijack the underlying HTTP transport, gaining access to...

7.4CVSS5.8AI score0.00838EPSS
SaveExploits1References3
Patchstack
Patchstack
added 2026/05/05 12:26 a.m.14 views

NPM: Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Response Tampering, Data Exfiltration, and Request Hijacking vulnerability discovered by ? in WordPress Npm axios versions = 0.31.0...

7.4CVSS5.8AI score0.00838EPSS
SaveExploits1References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/05 12:26 a.m.18 views

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking

Summary When Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before the application sees it, or b fully hijack the underlying HTTP transport, gaining access to...

7.4CVSS6.9AI score0.00838EPSS
SaveExploits1References3Affected Software1
EUVD
EUVD
added 2026/05/05 12:26 a.m.54 views

EUVD-2026-25588

Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking...

7.4CVSS5.8AI score0.00838EPSS
SaveExploits1References2
Patchstack
Patchstack
added 2026/05/05 12:25 a.m.23 views

NPM: Axios: Header Injection via Prototype Pollution

NPM: Axios: Header Injection via Prototype Pollution vulnerability discovered by ? in WordPress Npm axios versions = 0.31.0...

7.4CVSS5.8AI score0.00403EPSS
SaveExploits1References3Affected Software1
EUVD
EUVD
added 2026/05/05 12:25 a.m.11 views

EUVD-2026-25589

Axios: Header Injection via Prototype Pollution...

7.4CVSS5.8AI score0.00403EPSS
SaveExploits1References2
OSV
OSV
added 2026/05/05 12:25 a.m.18 views

GHSA-6CHQ-WFR3-2HJ9 Axios: Header Injection via Prototype Pollution

Summary A prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders,...

7.4CVSS5.8AI score0.00403EPSS
SaveExploits1References3
Github Security Blog
Github Security Blog
added 2026/05/05 12:25 a.m.20 views

Axios: Header Injection via Prototype Pollution

Summary A prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders,...

7.4CVSS5.8AI score0.00403EPSS
SaveExploits1References3Affected Software1
Rows per page
Query Builder