132288 matches found
Security Bulletin: Multiple Security Vulnerabilities in axios affect Content Cortex for Microsoft Office
Summary axios versions before 1.18.0 0.x: before 0.33.0 have multiple vulnerabilities CVSS up to 8.3, High. CVE-2026-67312/67313 are uncontrolled recursion issues in formDataToJSON that exhaust the call stack via deeply nested field names, causing denial of service. CVE-2026-67314/67316/67319 are...
CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...
CVE-2026-82267
Komodo (through version 2.3.2) contains a logic flaw in the /execute and /execute/{variant} API handlers, where internal resource identifiers are disclosed and audit log entries are written before permission checks are evaluated. Authenticated users can exploit this by guessing resource names to ...
CVE-2026-82267 Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/variant handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries...
CVE-2026-82257
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...
CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...
EUVD-2026-67583
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...
CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input
SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application...
CVE-2026-82257
SvelteKit versions before 2.69.1 are affected by a prototype pollution vulnerability in remote form functions that accept file input fields with user-controlled path names. An attacker can manipulate the deletion path to remove methods on the object prototype, potentially disabling application fu...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nodejs-jsonpointer (UTSA-2026-061527)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061527 advisory. This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer...
CVE-2026-78654
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654
A prototype pollution vulnerability in the deepExtend function of cleverbrush framework/deep (file libs/deep/src/deepExtend.ts) allows improper modification of object prototype attributes, enabling remote exploitation without authentication. Affected versions are up to 4.4.0 . The exploit has bee...
EUVD-2026-65304
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
Astra Linux – Vulnerability in highlight.js
Highlight.js is a syntax highlighter written in JavaScript. Versions of Highlight.js prior to 9.18.2 and 10.1.2 are vulnerable to “Prototype Pollution”. A malicious HTML code block can cause the base object’s prototype to be polluted during highlighting. If you allow users to insert custom HTML...
Astra Linux – Vulnerability in node-minimist
Minimist =1.2.5 is vulnerable to Prototype Pollution through the file index.js, the function setKey lines 69-95...
Astra Linux – Vulnerability in node-json-schema
JSON-schema is vulnerable to improperly controlled modification of object prototype attributes known as “Prototype Pollution”...
Astra Linux – Vulnerability in Firefox and Thunderbird
An attacker could have sent a message to the parent process, with the contents being used to index into a JavaScript object twice. This would lead to prototype pollution, and ultimately, attacker-controlled JavaScript would execute in the privileged parent process. This vulnerability affects...