CVE-2026-101909 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serializatio… |
CVE-2026-101908 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOption… |
CVE-2026-101905 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request opti… |
CVE-2026-101904 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.h… |
CVE-2026-101902 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit me… |
CVE-2026-101900 | | | 2026-09-28 | Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHe… |
CVE-2026-97724 | Medium | 4.3 | 2026-09-25 | A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a __proto__ propert… |
CVE-2026-97151 | | | 2026-09-24 | mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allo… |
CVE-2026-61834 | Medium | 4.3 | 2026-09-23 | scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership… |
CVE-2026-93753 | High | 7.5 | 2026-09-18 | deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys being written to target… |
CVE-2026-92781 | Medium | 6.3 | 2026-09-16 | Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttribu… |
CVE-2026-92779 | High | 7.6 | 2026-09-16 | Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content blo… |
CVE-2026-69200 | Low | 3.7 | 2026-09-16 | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-… |
CVE-2026-55091 | High | 7.5 | 2026-09-14 | flat-to-nested converts a hierarchy from a flat representation to a nested representation. Prior to 1.1.2, FlatToNested.prototype.convert in index.js uses atta… |
CVE-2026-55451 | | | 2026-09-14 | gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation ke… |
CVE-2026-61534 | Critical | 9.1 | 2026-09-14 | Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, a… |
CVE-2026-90771 | Low | 3.7 | 2026-09-13 | joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error cod… |
CVE-2026-89011 | High | 7.1 | 2026-09-10 | isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute… |
CVE-2026-86078 | Medium | 6.5 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from store… |
CVE-2026-81994 | High | 8.2 | 2026-09-08 | Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arb… |
CVE-2026-85625 | High | 8.1 | 2026-09-04 | sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. Th… |
CVE-2026-85063 | | | 2026-09-03 | node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by… |
CVE-2026-63376 | High | 8.2 | 2026-09-03 | toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__… |
CVE-2026-82404 | High | 8.3 | 2026-09-02 | TOON is a compact, human-readable serialization of JSON data for LLM prompts. Prior to 2.3.1, decoding attacker-controlled TOON with a __proto__, constructor… |
CVE-2026-84368 | Low | 3.7 | 2026-09-01 | joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the succ… |
CVE-2026-84367 | Low | 3.7 | 2026-09-01 | joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implem… |
CVE-2026-81887 | | | 2026-08-31 | Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, in… |
CVE-2026-82257 | Medium | 4.3 | 2026-08-28 | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-control… |
CVE-2026-78654 | High | 7.3 | 2026-08-25 | A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The… |
CVE-2026-78181 | High | 7.3 | 2026-08-24 | A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulatio… |
CVE-2026-78180 | High | 7.3 | 2026-08-24 | A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components… |
CVE-2026-78179 | Medium | 6.3 | 2026-08-24 | A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object… |
CVE-2026-78178 | High | 7.3 | 2026-08-24 | A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. Th… |
CVE-2026-78207 | Critical | 9.4 | 2026-08-24 | exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when… |
CVE-2026-18420 | High | 8.8 | 2026-08-20 | Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary cod… |
CVE-2026-77083 | Medium | 5.9 | 2026-08-20 | n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Fu… |
CVE-2026-23929 | Medium | 5.4 | 2026-08-18 | Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous proper… |
CVE-2026-71553 | | | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call an… |
CVE-2026-73654 | High | 8.5 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoi… |
CVE-2026-73647 | Medium | 5.6 | 2026-08-13 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/exten… |
CVE-2026-73562 | Medium | 6.5 | 2026-08-13 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-control… |
CVE-2026-73088 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, re… |
CVE-2026-72769 | High | 8.1 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit… |
CVE-2026-72749 | Medium | 6.5 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-no… |
CVE-2026-48170 | Critical | 9.1 | 2026-08-07 | `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object co… |
CVE-2026-71438 | | | 2026-08-06 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration se… |
CVE-2026-71437 | | | 2026-08-06 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture… |
CVE-2026-70610 | Medium | 5.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, obj… |
CVE-2026-14574 | Medium | 6.5 | 2026-08-05 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values witho… |
CVE-2026-67319 | Low | 3.7 | 2026-08-01 | axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype… |
CVE-2026-67316 | High | 7.4 | 2026-08-01 | axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate… |
CVE-2026-67314 | Medium | 6.5 | 2026-08-01 | axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolve… |
CVE-2026-54737 | High | 7.3 | 2026-07-31 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merge… |
CVE-2026-14893 | High | 7.3 | 2026-07-28 | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototyp… |
CVE-2026-66922 | | | 2026-07-28 | Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components.
… |
CVE-2026-65913 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array… |
CVE-2026-46681 | | | 2026-07-21 | @nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses f… |
CVE-2026-16266 | Medium | 4.0 | 2026-07-21 | Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the Jav… |
CVE-2026-53592 | Medium | 4.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/… |
CVE-2026-16151 | Medium | 6.3 | 2026-07-18 | A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the arg… |
CVE-2026-16150 | Medium | 6.3 | 2026-07-18 | A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the l… |
CVE-2026-54335 | Low | 3.7 | 2026-07-17 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) ut… |
CVE-2026-48819 | Medium | 4.8 | 2026-07-17 | Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied… |
CVE-2026-16008 | Medium | 6.3 | 2026-07-17 | A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/key… |
CVE-2026-45325 | High | 8.2 | 2026-07-16 | Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulner… |
CVE-2026-48795 | High | 8.6 | 2026-07-15 | AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nest… |
CVE-2026-49459 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve e… |
CVE-2026-15702 | Medium | 6.3 | 2026-07-14 | A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipul… |
CVE-2026-15699 | Medium | 6.3 | 2026-07-14 | A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component… |
CVE-2026-15698 | Medium | 6.3 | 2026-07-14 | A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a man… |
CVE-2026-15697 | Medium | 6.3 | 2026-07-14 | A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API… |
CVE-2026-15607 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the… |
CVE-2026-15598 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of th… |
CVE-2026-15538 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/ut… |
CVE-2026-56763 | Medium | 4.8 | 2026-07-11 | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ pr… |
CVE-2026-15195 | Medium | 6.3 | 2026-07-09 | A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts… |
CVE-2026-59206 | High | 7.1 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission c… |
CVE-2026-15187 | Medium | 4.3 | 2026-07-09 | A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the… |
CVE-2026-59876 | Medium | 4.8 | 2026-07-08 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map e… |
CVE-2026-57439 | Medium | 5.0 | 2026-07-08 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while p… |
CVE-2026-55886 | | | 2026-07-01 | Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pol… |
CVE-2026-54756 | | | 2026-07-01 | Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) —… |
CVE-2026-57926 | Low | 2.6 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack |
CVE-2026-54639 | High | 8.8 | 2026-06-24 | Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4… |
CVE-2026-54306 | Medium | 6.4 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to… |
CVE-2026-44791 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-44789 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-54312 | High | 8.5 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global p… |
CVE-2026-55388 | High | 8.1 | 2026-06-22 | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plai… |
CVE-2026-49252 | Critical | 9.9 | 2026-06-18 | deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to… |
CVE-2026-53676 | High | 7.2 | 2026-06-17 | ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the… |
CVE-2026-48714 | Critical | 9.1 | 2026-06-15 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missi… |
CVE-2026-48713 | Critical | 9.1 | 2026-06-15 | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-h… |
CVE-2026-12209 | Medium | 5.3 | 2026-06-15 | A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown function of the file src/filters/index.js of t… |
CVE-2026-12208 | Medium | 5.3 | 2026-06-15 | A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component… |
CVE-2026-53609 | Critical | 9.1 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths witho… |
CVE-2026-44495 | High | 7.0 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in reques… |
CVE-2026-44494 | High | 8.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget… |
CVE-2026-44490 | Medium | 4.8 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Obj… |
CVE-2026-44489 | Low | 3.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) ar… |