132342 matches found
Svelte SSR attribute spreading includes inherited properties from prototype chain
In server-side rendering, attribute spreading on elements e.g. enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where Object.prototype has already been polluted — a precondition outside of Svelte's control — this can cause unexpect...
Prototype Pollution
Overview swiper is a Most modern mobile touch slider and framework with hardware accelerated transitions Affected versions of this package are vulnerable to Prototype Pollution via the extendDefaults function. An attacker can modify the prototype of global objects by supplying crafted input,...
GHSA-HMX5-QPQ5-P643 Prototype pollution in swiper
Summary A prototype pollution vulnerability exists in the the npm package swiper =6.5.1, -1; let obj = ; var maliciouspayload = '"proto":"polluted":"yes"'; console.log.polluted; swiper.default.extendDefaultsJSON.parsemaliciouspayload; console.log.polluted; // prints yes - indicating that the patc...
Prototype pollution in swiper
Summary A prototype pollution vulnerability exists in the the npm package swiper =6.5.1, -1; let obj = ; var maliciouspayload = '"proto":"polluted":"yes"'; console.log.polluted; swiper.default.extendDefaultsJSON.parsemaliciouspayload; console.log.polluted; // prints yes - indicating that the patc...
Prototype Pollution
Overview org.webjars.npm:swiper is a Most modern mobile touch slider and framework with hardware accelerated transitions Affected versions of this package are vulnerable to Prototype Pollution via the extendDefaults function. An attacker can modify the prototype of global objects by supplying...
@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25535 via jspdf (>=4.0.0, <=4.1.0)
jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25535 Source advisory: OSV:GHSA-67PG-WM7F-Q7FJ...
Prototype Pollution
Rollbar.js is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of object merging in the merge function when rollbar.configure is called with untrusted input, which allows an attacker to manipulate object prototypes and potentially alter application behavior...
openSUSE 16 Security Update : golang-github-prometheus-prometheus (openSUSE-SU-2026:20239-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20239-1 advisory. - CVE-2026-25547: Fixed an unbounded brace range expansion leading to excessive CPU and memory consumption. bsc1257841 - CVE-2026-1615: Fixed...
HPESBNW04983 rev.1 - HPE Telco Service Orchestrator software, Prototype Pollution Vulnerability
Potential Security Impact: Remote: Unauthorized Data Access, Unauthorized Data Modification, unathorized modification SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator Prior to v5.5.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | ...
PT-2026-21358
Name of the Vulnerable Software and Affected Versions Swiper versions 6.5.1 through 12.1.1 Description Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. A prototype pollution issue exists in the shared/utils.mjs file, specifically at line 94, wher...
org.webjars.npm:github-com-nhn-tui-image-editor (3.10.1), org.webjars.npm:tui-image-editor (3.15.3) potentially affected by CVE-2026-27013 via org.webjars.npm:fabric (>=3.6.0, <=4.5.0)
org.webjars.npm:fabric MAVEN version =3.6.0, =4.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:fabric and may be impacted: - org.webjars.npm:github-com-nhn-tui-image-editor 3.10.1 - org.webjars.npm:tui-image-editor 3.15.3 Source...
@osdlabel/react (0.0.1), @osdlabel/solid (0.0.1) +1 more potentially affected by CVE-2026-27013 via fabric (7.1.0)
fabric NPM version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on fabric and may be impacted: - @osdlabel/react 0.0.1 - @osdlabel/solid 0.0.1 - osdlabel 0.0.1 Source cves: CVE-2026-27013 Source advisory: SNYK:JS-FABRIC-15317311...
02strich-markdown (>=1.0.0, <=1.0.2), @0xintuition/slang-cli (>=0.0.1-b, <=0.0.8) +1943 more potentially affected by CVE-2026-26996 via minimatch (>=4.1.1, <=4.2.3)
minimatch NPM version =4.1.1, =1.0.0, =0.0.1-b, =0.5.2, =5.0.2, =2.2.0, =1.1.4, =1.3.1, =1.0.0, =0.0.2-alpha-20220914223128-d706aab, =0.0.2-alpha-20220915073207-1bb0680, =0.0.2-alpha-20220914223128-d706aab, =1.1.8, =1.0.0, =1.5.0 and more Source cves: CVE-2026-26996 Source advisory:...
-tompan-reacttemplate (>=1.0.1, <=1.1.0), 02.aula (1.0.0) +55771 more potentially affected by CVE-2026-26996 via minimatch (>=3.0.0, <=3.1.2)
minimatch NPM version =3.0.0, =1.0.1, =1.1.0 - 02.aula 1.0.0 - 0726react 0.1.1 - 08cms 1.0.0 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 -...
SUSE-SU-2026:20540-1 Security update for cockpit-repos
This update for cockpit-repos fixes the following issues: Update to version 4.7. Security issues fixed: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257325. - CVE-2025-64718: js-yaml prototype pollution in merge bsc1255425...
OPENSUSE-SU-2026:20251-1 Security update for cockpit-repos
This update for cockpit-repos fixes the following issues: Update to version 4.7. Security issues fixed: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257325. - CVE-2025-64718: js-yaml prototype pollution in merge bsc1255425...
Prototype Pollution
jsonpath is vulnerable to Prototype Pollution. The vulnerability is due to unsafe handling of object paths in the value function within lib/index.js, where attacker-controlled property paths can modify Object.prototype, allowing arbitrary property injection into global objects and potentially...
Security update for golang-github-prometheus-prometheus (critical)
openSUSE security update: security update for golang-github-prometheus-prometheus ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20239-1 Rating: critical References: bsc1257442 bsc1257841 bsc1257897 Cross-References: CVE-2025-61140 CVE-2026-1615...
5-ifc-check-cli (1.0.0), 7ghost (>=4.11.2, <=4.11.46) +3946 more potentially affected by CVE-2026-26278 via fast-xml-parser (>=4.1.3, <=4.5.3)
fast-xml-parser NPM version =4.1.3, =4.11.2, =0.1.1, =0.0.2, =1.0.1, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2026-26278 Source advisory: SNYK:JS-FASTXMLPARSER-15307668...
