CVE-2026-77415

JSONata (a JSON query and transformation language) is vulnerable to arbitrary code execution in versions prior to 1.8.8 and 2.2.1 . An attacker can craft JSONata expressions that chain multiple object-integrity weaknesses—overwriting $clone, exposing internal functions via $merge.*, replacing pro...

Prototype Pollution

Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Prototype Pollution via unsafe object creation patterns throughout the codebase src/jsonata.js, src/functions.js, src/parser.js, src/signature.js, and src/datetime.js. An attacker who...

EUVD-2026-64083

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

CVE-2026-77414 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype a...

CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

CVE-2026-77413 JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

Security Bulletin: IBM Spectrum Control is vulnerable to weaknesses related to picomatch-2.2.2.tgz (CVE-2026-33671, CVE-2026-33672)

Summary picomatch is vulnerable to a Inefficient Regular Expression Complexity DOS, Improperly Controlled Modification of Object Prototype Attributes / Prototype Reference attacks. This vulnerability affects IBM Spectrum Control. Vulnerability Details CVEID:CVE-2026-33671 DESCRIPTION: Picomatch i...

CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

EUVD-2026-63829

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-74866

@fastify/busboy (a multipart form-data parser for Node.js) is vulnerable to CRLF injection via the Content-Disposition filename and field name. The part-header parser splits lines only on the two-byte CRLF sequence, so a lone carriage return or line feed embedded in a part header is carried verba...

CVE-2026-74866 @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...

CVE-2026-18420

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

EUVD-2026-63592

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

CVE-2026-18420

Improper input validation in OpenSearch Dashboards' TSVB plugin enables prototype pollution via crafted JSON to the metrics visualization API, yielding authenticated remote code execution. CVSS 3.1 scores 8.8 (HIGH). Affected versions are fixed in OpenSearch Dashboards 3.8.0. Exploitation in the ...

CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

CVE-2026-18420 RCE via Prototype Pollution in OpenSearch Dashboards

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

NPM: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

NPM: gettext-converter: Prototype pollution in js2i18next via crafted translation keys vulnerability discovered by ? in WordPress Npm gettext-converter versions 1.3.3...

gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

GHSA-F4JP-RW7W-CCWG gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

Impact js2i18next is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator default and uses each segment as a dynamic object key while building the output object. A key whose segment is proto e.g. protogcPolluted causes the converter to resolv...

CVE-2026-40345

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...