grid-engine (0.1.2), taffy (>=0.8.3, <=0.9.1) potentially affected by CVE-2026-42199 via grid (>=0.17.0, <=0.18.0)

grid CARGO version =0.17.0, =0.8.3, =0.9.1 Source cves: CVE-2026-42199 Source advisory: OSV:GHSA-38C5-483C-4QQP...

@angstone/micro (0.0.1), @angstone/microservice (0.0.17) +4 more potentially affected by CVE-2019-10790 via taffy (2.6.2)

taffy NPM version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on taffy and may be impacted: - @angstone/micro 0.0.1 - @angstone/microservice 0.0.17 - anrajs =1.0.0, =0.0.1, =0.0.7, =1.0.6 - neyka 3.0.0 Source cves: CVE-2019-10790 Source advisory...

Taffy has an unspecified vulnerability

Taffy is a data selection engine that supports insertion, updating and statistics. A security vulnerability exists in taffy 2.6.2 and earlier versions. An attacker can exploit the vulnerability to access arbitrary data entries in the DB with the help of user input with redundant attributes...

Insecure Direct Object Reference

taffy is vulnerable to direct object reference. An attacker is able to tamper the internal properties of the data item in its database and access any item by referencing an easily guessable internal index...

@angstone/micro (0.0.1), @angstone/microservice (0.0.17) +4 more potentially affected by CVE-2019-10790 via taffy (2.6.2)

taffy NPM version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on taffy and may be impacted: - @angstone/micro 0.0.1 - @angstone/microservice 0.0.17 - anrajs =1.0.0, =0.0.1, =0.0.7, =1.0.6 - neyka 3.0.0 Source cves: CVE-2019-10790 Source advisory...

Internal Property Tampering

Overview taffy is an opensouce library that brings database features into your JavaScript applications. Affected versions of this package are vulnerable to Internal Property Tampering. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be...