CVE-2026-119051

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-119051

The flat library (versions through 6.0.1 ) contains an uncontrolled resource allocation vulnerability within the unflatten() function. The root cause is the processing of unbounded numeric keys, which allows an attacker to create massive sparse arrays. This can result in a Denial of Service (DoS)...

CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

EUVD-2026-112817

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: The issue in fdt: fix off-by-one error in unflattendtnodes Commit 78c44d910d3e “drivers/of: Fix depth when unflattening devicetree” forgot to fix the depth check in the loop body of unflattendtnodes. This could lead to an overflo...

Prototype Pollution

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Prototype Pollution via the unflatten function in src/parse.js, where object keys parsed from untrust...

Prototype Pollution

Overview org.webjars.npm:devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Prototype Pollution via the unflatten function in src/parse.js, where object keys...

CVE-2026-92781

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

CVE-2026-92781 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

EUVD-2026-81044

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

CVE-2026-92781

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

CVE-2026-92781

Builder.io Gen2 SDKs (through versions 5.2.11 and 0.25.13 ) are affected by a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. An attacker can craft preview links containing __proto__ or prototype segments t...

CVE-2026-92781 Builder.io Gen2 SDKs through 5.2.11 Prototype Pollution via builder.userAttributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

CVE-2026-92781: Improperly Controlled Modification of Object Prototype Attributes

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with proto or prototype segments to pollute...

PT-2026-94058

Name of the Vulnerable Software and Affected Versions Builder.io Gen2 SDKs versions 5.2.11 and 0.25.13 Description A prototype pollution issue exists in the unflatten helper. This occurs when the SDK processes builder.userAttributes query parameters without implementing prototype guards. An...

EUVD-2026-43601

An issue in MikroTIk SIA Mikrotikls, Latvia RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten function in libumsg.so...

CVE-2026-39042

An issue in MikroTIk SIA Mikrotikls, Latvia RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten function in libumsg.so...

CVE-2026-39042: Integer Overflow or Wraparound

An issue in MikroTIk SIA Mikrotikls, Latvia RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten function in libumsg.so...

CVE-2026-39042

An issue in MikroTIk SIA Mikrotikls, Latvia RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten function in libumsg.so...

CVE-2026-39042

A vulnerability in MikroTik RouterOS (versions 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 ) allows a remote attacker to cause a denial of service . The root cause is located in the unflatten() function within the libumsg.so library. While the vulnerability is confirmed, no specific exploit...