132303 matches found
CVE-2026-78654
A prototype pollution vulnerability in the deepExtend function of cleverbrush framework/deep (file libs/deep/src/deepExtend.ts) allows improper modification of object prototype attributes, enabling remote exploitation without authentication. Affected versions are up to 4.4.0 . The exploit has bee...
EUVD-2026-65304
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
CVE-2026-78654 cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution
A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. T...
Astra Linux – Vulnerability in highlight.js
Highlight.js is a syntax highlighter written in JavaScript. Versions of Highlight.js prior to 9.18.2 and 10.1.2 are vulnerable to “Prototype Pollution”. A malicious HTML code block can cause the base object’s prototype to be polluted during highlighting. If you allow users to insert custom HTML...
Astra Linux – Vulnerability in node-minimist
Minimist =1.2.5 is vulnerable to Prototype Pollution through the file index.js, the function setKey lines 69-95...
Astra Linux – Vulnerability in node-json-schema
JSON-schema is vulnerable to improperly controlled modification of object prototype attributes known as “Prototype Pollution”...
Astra Linux – Vulnerability in Firefox and Thunderbird
An attacker could have sent a message to the parent process, with the contents being used to index into a JavaScript object twice. This would lead to prototype pollution, and ultimately, attacker-controlled JavaScript would execute in the privileged parent process. This vulnerability affects...
Astra Linux – Vulnerability in dojo
All versions of the dojo package are vulnerable to Prototype Pollution through the setObject function...
Astra Linux – Vulnerability in node-json5
JSON5 is an extension to the popular JSON file format, designed to make writing and maintaining it more straightforward, especially for configuration files. The parse method in the JSON5 library, as of versions 1.0.1 and 2.2.1, does not restrict the parsing of keys named proto. This allows...
Astra Linux – Vulnerability in node-ini
This affects the package ini before version 1.3.6. If an attacker submits a malicious INI file to an application that parses it using ini.parse, they will corrupt the prototype within the application. This can be further exploited depending on the context...
Astra Linux – Vulnerability in node-y18n
The package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution...
Astra Linux – Vulnerability in Node-EJS
The ejs also known as Embedded JavaScript templates package in Node.js before version 3.1.10 lacked certain measures to prevent pollution...
Astra Linux – Vulnerability in Node.js
Due to the formatting logic of the "console.table" function, it is not safe to allow user-controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". This approach causes prototy...
Astra Linux – Vulnerability in node-form-data
The use of insufficiently random values in form-data allows for HTTP Parameter Pollution HPP. This vulnerability is associated with the program file lib/formdata.Js. This issue affects form-data versions: 2.5.4, 3.0.0 – 3.0.3, 4.0.0 – 4.0.3...
Astra Linux – Vulnerability in node-loader-utils
A prototype pollution vulnerability exists in the parseQuery function in parseQuery.js, within the webpack-loader-utils module. This issue affects all versions prior to 1.4.1 and 2.0.3...
Astra Linux – Vulnerability in node-tough-cookie
Versions of the tough-cookie package before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in the rejectPublicSuffixes=false mode. This issue arises from the way in which the objects are initialized...
Astra Linux – Vulnerability in PHP 8.1
In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, and 8.3. before 8.3.12, when using PHP-FPM SAPI and the option catchworkersoutput is set to yes, it is possible to manipulate the log messages by removing up to 4 characters from the log messages. Additionally, if PHP-FPM is configured to us...
Astra Linux – Vulnerability in Firefox, Thunderbird
If an attacker were able to corrupt the methods of an Array object in JavaScript through prototype pollution, they could have executed JavaScript code under their control in a privileged context. This vulnerability affects Firefox ESR 91.9.1, Firefox 100.0.2, Firefox for Android 100.3.0, and...
