CVE-2026-73654 | High | 8.5 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoi… |
CVE-2026-73647 | Medium | 5.6 | 2026-08-13 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/exten… |
CVE-2026-73562 | Medium | 6.5 | 2026-08-13 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-control… |
CVE-2026-73088 | High | 7.5 | 2026-08-11 | Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, re… |
CVE-2026-72769 | | | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit… |
CVE-2026-72749 | | | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-no… |
CVE-2026-48170 | Critical | 9.1 | 2026-08-07 | `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object co… |
CVE-2026-71438 | | | 2026-08-06 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration se… |
CVE-2026-71437 | | | 2026-08-06 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture… |
CVE-2026-70610 | Medium | 5.4 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, obj… |
CVE-2026-14574 | Medium | 6.5 | 2026-08-05 | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values witho… |
CVE-2026-67319 | | | 2026-08-01 | axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype… |
CVE-2026-67316 | | | 2026-08-01 | axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate… |
CVE-2026-67314 | | | 2026-08-01 | axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolve… |
CVE-2026-54737 | High | 7.3 | 2026-07-31 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merge… |
CVE-2026-14893 | High | 7.3 | 2026-07-28 | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototyp… |
CVE-2026-66922 | | | 2026-07-28 | Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components.
… |
CVE-2026-65913 | Medium | 6.1 | 2026-07-23 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array… |
CVE-2026-46681 | | | 2026-07-21 | @nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the _copyProps function in lib/src/object/copy.ts uses f… |
CVE-2026-16266 | Medium | 4.0 | 2026-07-21 | Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the Jav… |
CVE-2026-53592 | Medium | 4.6 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/… |
CVE-2026-16151 | Medium | 6.3 | 2026-07-18 | A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the arg… |
CVE-2026-16150 | Medium | 6.3 | 2026-07-18 | A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the l… |
CVE-2026-54335 | Low | 3.7 | 2026-07-17 | Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) ut… |
CVE-2026-48819 | Medium | 4.8 | 2026-07-17 | Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied… |
CVE-2026-16008 | Medium | 6.3 | 2026-07-17 | A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/key… |
CVE-2026-45325 | High | 8.2 | 2026-07-16 | Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulner… |
CVE-2026-48795 | High | 8.6 | 2026-07-15 | AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nest… |
CVE-2026-49459 | Medium | 6.1 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve e… |
CVE-2026-15702 | Medium | 6.3 | 2026-07-14 | A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipul… |
CVE-2026-15699 | Medium | 6.3 | 2026-07-14 | A vulnerability was identified in spencermountain compromise up to 14.15.1. Affected is the function nlp.extend of the file src/API/extend.js of the component… |
CVE-2026-15698 | Medium | 6.3 | 2026-07-14 | A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a man… |
CVE-2026-15697 | Medium | 6.3 | 2026-07-14 | A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API… |
CVE-2026-15607 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the… |
CVE-2026-15598 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of th… |
CVE-2026-15538 | Medium | 6.3 | 2026-07-13 | A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This ma… |
CVE-2026-56763 | Medium | 4.8 | 2026-07-11 | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially crafted form field names to create objects with __proto__ pr… |
CVE-2026-15195 | Medium | 6.3 | 2026-07-09 | A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts… |
CVE-2026-59206 | High | 7.1 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission c… |
CVE-2026-15187 | Medium | 4.3 | 2026-07-09 | A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the… |
CVE-2026-59876 | Medium | 4.8 | 2026-07-08 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map e… |
CVE-2026-57439 | Medium | 5.0 | 2026-07-08 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, the Series Chart operation accepts __proto__ as a key while p… |
CVE-2026-55886 | | | 2026-07-01 | Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. Versions prior to 4.12.26 are vulnerable to Prototype Pol… |
CVE-2026-54756 | | | 2026-07-01 | Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.18, Jodit.configure(options) —… |
CVE-2026-57926 | Low | 2.6 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack |
CVE-2026-54639 | High | 8.8 | 2026-06-24 | Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4… |
CVE-2026-54306 | Medium | 6.4 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollution vulnerability allowed a crafted public webhook payload to… |
CVE-2026-44791 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-44789 | Critical | 9.9 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authenticated user with permission to create or modify workflows… |
CVE-2026-54312 | High | 8.5 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global p… |
CVE-2026-55388 | High | 8.1 | 2026-06-22 | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plai… |
CVE-2026-49252 | Critical | 9.9 | 2026-06-18 | deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Versions prior to 10.0.5 are vulnerable to… |
CVE-2026-53676 | High | 7.2 | 2026-06-17 | ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the… |
CVE-2026-48714 | Critical | 9.1 | 2026-06-15 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missi… |
CVE-2026-48713 | Critical | 9.1 | 2026-06-15 | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-h… |
CVE-2026-12209 | Medium | 5.3 | 2026-06-15 | A security vulnerability has been detected in RubyLouvre avalon up to 2.2.10. The impacted element is an unknown function of the file src/filters/index.js of t… |
CVE-2026-12208 | Medium | 5.3 | 2026-06-15 | A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the file src/jsonata.js of the component… |
CVE-2026-53609 | Critical | 9.1 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4.30.0, `apos.util.set()` traverses dot-notation paths witho… |
CVE-2026-44495 | High | 7.0 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in reques… |
CVE-2026-44494 | High | 8.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget… |
CVE-2026-44490 | Medium | 4.8 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Obj… |
CVE-2026-44489 | Low | 3.7 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) ar… |
CVE-2026-46625 | High | 7.5 | 2026-06-10 | JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with fo… |
CVE-2026-45302 | High | 8.2 | 2026-06-01 | parse-nested-form-data is a tiny node module for parsing FormData by name into objects and arrays. Prior to version 1.0.1, parseFormData() walks bracket and do… |
CVE-2026-46510 | High | 8.2 | 2026-05-29 | form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys (e.g. name[sub]) into nested objects wi… |
CVE-2026-46509 | High | 8.2 | 2026-05-28 | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor… |
CVE-2026-44483 | High | 8.2 | 2026-05-27 | RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6.0.4 and 7.0.2, setPath in @rvf/set-get… |
CVE-2026-44966 | High | 8.3 | 2026-05-26 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in… |
CVE-2026-9101 | Medium | 4.3 | 2026-05-20 | Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user beh… |
CVE-2026-8657 | High | 8.2 | 2026-05-16 | Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.p… |
CVE-2026-44005 | Critical | 10.0 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forw… |
CVE-2026-44292 | Medium | 5.3 | 2026-05-13 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable… |
CVE-2026-44290 | High | 7.5 | 2026-05-13 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse t… |
CVE-2026-8161 | High | 7.5 | 2026-05-12 | multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that… |
CVE-2026-41690 | High | 8.6 | 2026-05-08 | 18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unaut… |
CVE-2026-42264 | High | 7.4 | 2026-05-08 | Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPa… |
CVE-2025-63704 | Critical | 9.8 | 2026-05-07 | NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges th… |
CVE-2025-63703 | Critical | 9.8 | 2026-05-07 | npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js(). |
CVE-2026-42232 | High | 8.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with permission to create or modify w… |
CVE-2026-42231 | High | 8.8 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, a flaw in the xml2js library used to parse XML request bodi… |
CVE-2026-42077 | Medium | 5.2 | 2026-05-04 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a prototype pollution vulnerability in the mailbox store module allows at… |
CVE-2026-42044 | Medium | 6.5 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget"… |
CVE-2026-42041 | Medium | 4.8 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget"… |
CVE-2026-42035 | High | 7.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (li… |
CVE-2026-42033 | High | 7.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with… |
CVE-2026-41238 | Medium | 6.9 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 through 3.3.3 are vulnerable to a prototype pollution-based XS… |
CVE-2026-6621 | High | 7.3 | 2026-04-20 | A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the a… |
CVE-2026-6594 | High | 7.3 | 2026-04-20 | A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument __proto__/constructor.proto… |
CVE-2026-34626 | Medium | 6.3 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attribut… |
CVE-2026-34622 | High | 8.6 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attribut… |
CVE-2026-34621 | High | 8.6 | 2026-04-11 | Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype… |
CVE-2026-40190 | Medium | 5.6 | 2026-04-10 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains… |
CVE-2026-35209 | High | 7.5 | 2026-04-06 | defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed… |
CVE-2026-2950 | Medium | 6.5 | 2026-03-31 | Impact:
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://gi… |
CVE-2026-34221 | Critical | 9.1 | 2026-03-31 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, a prototype pollutio… |
CVE-2026-33994 | Critical | 9.8 | 2026-03-27 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototy… |
CVE-2026-33993 | Critical | 9.8 | 2026-03-27 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus… |
CVE-2026-33916 | Medium | 4.7 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, `resolvePartial()` in the Handlebars runtime re… |
CVE-2026-33672 | Medium | 5.3 | 2026-03-26 | Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POS… |
CVE-2026-33696 | High | 8.8 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with permission to create or modify w… |