Lucene search
+L

132306 matches found

vulnersOsv
vulnersOsv
added 2026/04/21 8:39 p.m.8 views

@chocolatey-software/astro (2.7.0), @kyro-cms/admin (0.1.2) +8 more potentially affected by CVE-2026-41067 via astro (>=6.0.0-beta.1, <=6.1.5)

astro NPM version =6.0.0-beta.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.4.2, =0.0.1, =0.0.1, =0.0.7 Source cves: CVE-2026-41067 Source advisory: OSV:GHSA-J687-52P2-XCFF...

6.1CVSS5.8AI score0.00189EPSS
SaveExploits1
RedHat Linux
RedHat Linux
added 2026/04/21 5:31 p.m.15 views

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass

A flaw was found in Lodash. An attacker can exploit a prototype pollution vulnerability in the .unset and .omit functions by bypassing a security check. This bypass is achieved by providing array-wrapped path segments, which allows for the deletion of properties from built-in JavaScript prototype...

6.5CVSS6.5AI score0.00317EPSS
SaveExploits0References5
OSV
OSV
added 2026/04/21 9:26 a.m.6 views

SUSE-SU-2026:1524-1 Security update 5.1.3 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-lusitaniae-apacheexporter: - Internal changes to fix build issues with no impact for customers golang-github-prometheus-prometheus: - Security issues fixed: CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup bsc1258893 +...

9.8CVSS6.5AI score0.01929EPSS
SaveExploits5References48
IBM Security Bulletins
IBM Security Bulletins
added 2026/04/21 7:28 a.m.8 views

Security Bulletin: IBM Storage Protect Operations Center is affected by vulnerabilities in the dojo-profile library that could allow prototype pollution or improper handling of crafted PNG inputs (CVE-2021-23450, CVE-2008-6681, CVE-2010-2273).

Summary IBM Storage Protect Operations Center uses the dojo-profile library in certain components. Vulnerabilities in this library may allow prototype pollution or improper handling of specially crafted PNG files, which could lead to memory corruption or denial-of-service conditions in applicatio...

9.8CVSS6.8AI score0.30367EPSS
SaveExploits4Affected Software1
EUVD
EUVD
added 2026/04/20 9:30 a.m.10 views

EUVD-2026-23812

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

7.5CVSS5.4AI score0.00336EPSS
SaveExploits0References5
NVD
NVD
added 2026/04/20 9:16 a.m.13 views

CVE-2026-6621

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

7.5CVSS0.00336EPSS
SaveExploits0References4
CVE
CVE
added 2026/04/20 8:30 a.m.26 views

CVE-2026-6621

The CVE-2026-6621 entry concerns a prototype pollution vulnerability in 1024bit extend-deep (versions up to 0.1.6). The affected surface is an unknown function in index.js where manipulation of the proto object enables improper modification of prototype attributes. Exploitation is described as re...

7.5CVSS6.8AI score0.00336EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/04/20 8:30 a.m.50 views

CVE-2026-6621 1024bit extend-deep index.js prototype pollution

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

7.5CVSS0.00336EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/04/20 8:30 a.m.6 views

CVE-2026-6621 1024bit extend-deep index.js prototype pollution

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

7.5CVSS5.4AI score0.00336EPSS
SaveExploits0References4
GithubExploit
GithubExploit
added 2026/04/20 8:11 a.m.224 views

Exploit for CVE-2026-3462

CVE-2026-3462 Acrobat Reader | Improperly Controlled Modifica...

8.6CVSS7.3AI score0.07086EPSS
SaveExploits4
OSV
OSV
added 2026/04/20 3:34 a.m.13 views

GHSA-3JC6-6R48-V6QF Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization

A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was...

7.3CVSS6.9AI score0.00336EPSS
SaveExploits0References6
vulnersOsv
vulnersOsv
added 2026/04/20 3:34 a.m.5 views

@brikcss/rollup-config-generator (>=0.0.15, <=0.0.16), @brikcss/stakcss (>=0.0.0, <=0.9.1) +9 more potentially affected by CVE-2026-6594 via @brikcss/merge (>=1.0.7, <=1.3.0)

@brikcss/merge NPM version =1.0.7, =0.0.15, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.1, =0.2.0, =0.10.0 Source cves: CVE-2026-6594 Source advisory: OSV:GHSA-3JC6-6R48-V6QF...

7.5CVSS7.3AI score0.00336EPSS
SaveExploits0
Github Security Blog
Github Security Blog
added 2026/04/20 3:34 a.m.116 views

Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization

A Prototype Pollution vulnerability was determined in brikcss merge up to 1.3.0. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The vendor was...

7.5CVSS6.9AI score0.00336EPSS
SaveExploits0References6Affected Software1
CVE
CVE
added 2026/04/20 1:45 a.m.30 views

CVE-2026-6594

A vulnerability identified as CVE-2026-6594 affects brikcss merge up to version 1.3.0. The issue enables prototype pollution by manipulating proto /constructor.prototype/prototype, with remote exploitation possible. Product/vendor details beyond brikcss merge are not provided in the connected doc...

7.5CVSS6.9AI score0.00336EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/04/20 1:45 a.m.46 views

CVE-2026-6594 brikcss merge prototype pollution

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The...

7.5CVSS0.00336EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/04/20 1:45 a.m.5 views

CVE-2026-6594 brikcss merge prototype pollution

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The...

7.5CVSS6.9AI score0.00336EPSS
SaveExploits0References4
CNNVD
CNNVD
added 2026/04/20 12:00 a.m.16 views

extend-deep 安全漏洞

extend-deep is a JavaScript library developed by Hangga, designed for deeply recursive object merging. Versions of extend-deep 0.1.6 and earlier contained a security vulnerability, which stemmed from improper handling of the proto parameter in the index.js file. This vulnerability could lead to...

7.5CVSS7.1AI score0.00336EPSS
SaveExploits0References1
Snyk
Snyk
added 2026/04/19 9:00 p.m.8 views

Cross-site Scripting (XSS)

Overview org.webjars.npm:dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS leading to cross-site scripting, via custom elements. When CUSTOMELEMENTHANDLING is not enabled, and an attacker has already pollut...

6.9CVSS5.3AI score0.00225EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/19 9:00 p.m.14 views

Cross-site Scripting (XSS)

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Cross-site Scripting XSS leading to cross-site scripting, via custom elements. When CUSTOMELEMENTHANDLING is not enabled, and an attacker has already polluted the prototype...

6.9CVSS5.3AI score0.00225EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/04/19 9:00 p.m.7 views

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2135 more potentially affected by CVE-2026-41238 via dompurify (>=3.0.1, <=3.3.3)

dompurify NPM version =3.0.1, =0.3.96, =0.5.12, =0.3.33, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =0.2.10 and more Source cves: CVE-2026-41238 Source advisory: SNYK:JS-DOMPURIFY-16132234...

6.9CVSS6.1AI score0.00225EPSS
SaveExploits0
Rows per page
Query Builder