#cwe-1321

共收录 238 条相关情报。

漏洞预警2026-10-30 发布MEDIUM

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses ...

CVE-2026-63402

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` che

来源摘录 · NVD

#cve #cwe-1321 #cwe-471

安全公告2026-10-30 发布MEDIUM

Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

CVE-2026-118777

### Summary The `forge.http` client stored cookies from `Set-Cookie` response headers in a plain object keyed by cookie

来源摘录 · GitHub Advisory

#advisory #cwe-1321 #npm #severity:medium

漏洞预警2026-10-30 发布MEDIUM

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-prope...

CVE-2026-119569

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-co

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-29 发布MEDIUM

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the forge.http client stored cookie names and paths from Set...

CVE-2026-118777

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-1321 #npm #severity:medium

漏洞预警2026-10-28 发布HIGH

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users to alter built-in object behaviour by saving workflows w...

CVE-2026-118678

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged users

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布HIGH

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto...

CVE-2026-118649

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner projec

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering eac...

CVE-2026-118250

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts foll

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. O...

CVE-2026-118249

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data col

来源摘录 · NVD

#cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejectin...

CVE-2026-118248

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode wal

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use...

CVE-2026-118247

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Gri

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1321

漏洞预警2026-10-28 发布INFO

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by Da...

CVE-2026-118243

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCu

来源摘录 · NVD / OSV.dev

#advisory #cve #cwe-1321

漏洞预警2026-10-27 发布INFO

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interfa...

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/netw

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

安全公告2026-10-27 发布INFO

systeminformation: Prototype pollution in `networkStats()` via the interface name

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/netw

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1321

安全公告2026-10-22 发布INFO

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

CVE-2026-114142

### Summary CVE-2026-63376 described prototype pollution through __proto__ key-path desynchronization and was fixed in 4

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-1321 #severity:high

安全公告2026-10-22 发布INFO

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

CVE-2026-114604

## Report metadata | Field | Value | | --- | --- | | Package | `@graphql-tools/utils` (npm, `pkg:github/ardatan/graphql

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-1321 #severity:high

漏洞预警2026-10-21 发布INFO

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prototype because quoteDottedString() in ...

CVE-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope

来源摘录 · NVD

#cve #cwe-1321

安全公告2026-10-21 发布INFO

toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

CVE-2026-114142

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1321

漏洞预警2026-10-21 发布INFO

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these...

CVE-2026-107588

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 1

来源摘录 · NVD

#cve #cwe-1321 #cwe-79

安全公告2026-10-21 发布INFO

Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts

CVE-2026-107588

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 1

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1321 #cwe-79

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of ApostropheCMS, an account with view-draft access can submit a proje...

CVE-2026-113666

ApostropheCMS is an open-source Node.js content management system. Prior to 1.1.0 of db-connect and 4.33.0 of Apostrophe

历史摘要 · 未重新核验 · NVD

#cve #cwe-400 #cwe-1321