共收录 238 条相关情报。
← 返回所有主题CVE-2026-46510
form-data-objectizer converts FormData to object. Prior to 1.0.1, form-data-objectizer walks bracket-notation form keys
CVE-2026-44483
RVF (formerly Remix Validated Form) provides easy form validation and state management for React. From 6.0.0 to before 6
CVE-2026-44966
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pol
CVE-2026-46681
## Summary The _copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties wit
CVE-2026-46625
## Summary `js-cookie`'s internal `assign()` helper copies properties with `for...in` + plain assignment. When the sour
CVE-2026-9101
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering she
CVE-2026-9101
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering she
CVE-2026-8161
### Impact multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a
CVE-2026-45325
### Impact Prototype pollution vulnerability in @tmlmobilidade/utils for setValueAtPath(). ### Patches A fix is availab
CVE-2026-45302
## Summary `parseFormData()` walks bracket and dot-notation FormData field names into nested objects without filtering
CVE-2026-46510
## Summary `form-data-objectizer` walks bracket-notation form keys (e.g. `name[sub]`) into nested objects without filte
CVE-2026-8657
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() a
CVE-2026-8657
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() a
CVE-2026-46509
### Impact Prototype pollution is possible when property paths contain `__proto__`/`constructor`/`prototype`. The proper
CVE-2026-44005
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-r
CVE-2026-44292
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated
CVE-2026-44290
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed ce
CVE-2026-44292
## Summary protobufjs generated message constructors copied enumerable properties from a provided properties object wit
CVE-2026-44291
## Summary protobufjs used plain objects with inherited prototypes for internal type lookup tables used by generated en
CVE-2026-44290
## Summary protobufjs allowed certain schema option paths to traverse through inherited object properties while applyin