CVE-2026-78180

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78179

A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled...

CVE-2026-78181 ractivejs ractive Keypath Ractive#set prototype pollution

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractiveset of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been...

CVE-2026-78181 ractivejs ractive Keypath Ractive#set prototype pollution

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractiveset of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been...

EUVD-2026-64704

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractiveset of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been...

CVE-2026-78181

CVE-2026-78181 is a prototype pollution vulnerability in ractivejs ractive versions up to 1.4.4 . The flaw resides in the Ractive#set function within the Keypath Handler component, where improper control of object prototype attribute modification allows a remote, unauthenticated attacker to injec...

CVE-2026-78178

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180 alibaba-fusion next deepMerge index.tsx ConfigProvider.getContextProps prototype pollution

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

EUVD-2026-64702

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modificati...

CVE-2026-78180

alibaba-fusion next (up to version 1.27.34) is affected by a prototype pollution vulnerability in the deepMerge component, specifically in the ConfigProvider.getContextProps function within components/dialog/index.tsx. By manipulating the locale argument, an attacker can improperly control object...

CVE-2026-78179

CVE-2026-78179 affects rexrainbow phaser3-rex-notes (versions up to 1.80.17 ). The vulnerability resides in the SetValue function within plugins/utils/object/SetValue.js, part of the BehaviorTree Blackboard Data Interface component. By manipulating the key argument, an attacker can trigger protot...

CVE-2026-78179 rexrainbow phaser3-rex-notes BehaviorTree Blackboard Data SetValue.js SetValue prototype pollution

A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled...

EUVD-2026-64701

A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled...

EUVD-2026-64700

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...

CVE-2026-78178 jQWidgets jqx-all.js jqxBaseFramework.extend prototype pollution

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The report...

CVE-2026-78178

jQWidgets up to 24.0.1 is affected by a prototype pollution vulnerability in the JQXLite.extend / jqxBaseFramework.extend functions within the file jqwidgets/jqx-all.js . The root cause is improper control over modification of object prototype attributes, which can be triggered remotely with no a...

Prototype Pollution

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to Prototype Pollution through Note.model serialization in lib/utils/under-dash.js. An attacker can modify Object.prototype and influence late...

CVE-2026-78207

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...

CVE-2026-78207

exceljs-hardened before 5.0.0 (also tracked as exceljs through 4.4.0) contains a prototype pollution vulnerability in the deepMerge helper. The helper fails to reject __proto__, constructor, or prototype keys when merging note objects, allowing an attacker to assign parsed JSON with a malicious _...