#cwe-1321

共收录 238 条相关情报。

漏洞预警2026-10-20 发布INFO

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send a crafted link whose query string is automatically parse...

CVE-2026-113659

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an unauthenticated attacker can send

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-1321

安全公告2026-10-15 发布INFO

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution...

CVE-2026-110848

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-1321 #severity:medium

安全公告2026-10-15 发布INFO

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the...

CVE-2026-110842

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the MCP workflow-validation t

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-1321 #severity:high

漏洞预警2026-10-13 发布INFO

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachab...

CVE-2026-109758

Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable

历史摘要 · 未重新核验 · NVD

#cve #cwe-798 #cwe-1321

漏洞预警2026-10-12 发布INFO

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing proto, constructor or prot...

CVE-2021-48012

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

安全公告2026-10-07 发布INFO

Payload: Remote Code Execution through first-register

CVE-2026-105858

### Impact A crafted request to the public first-register operation can be used to perform a RCE exploit. **You are aff

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-94 #cwe-1321 #severity:high

漏洞预警2026-10-06 发布INFO

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assign...

CVE-2026-106448

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map dec

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request to the public first...

CVE-2026-105858

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1321

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an at...

CVE-2026-105857

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1321

漏洞预警2026-10-06 发布INFO

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an unauthenticated user ca...

CVE-2026-105844

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

安全公告2026-10-06 发布INFO

Payload: Prototype pollution in Payload Import Export plugin

CVE-2026-105844

### Impact An unauthenticated user could cause unintended application behavior when the Import Export plugin is enabled,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-1321 #severity:critical

漏洞预警2026-10-05 发布INFO

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited pr...

CVE-2026-104852

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tool

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

安全公告2026-10-05 发布INFO

GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

CVE-2026-104852

Closed by https://github.com/ardatan/graphql-tools/pull/8423 Mitigated in Hive Gateway by https://github.com/graphql-hiv

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-1321 #severity:high

漏洞预警2026-10-02 发布INFO

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSm...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, th

历史摘要 · 未重新核验 · NVD

#cve #cwe-915 #cwe-1321

漏洞预警2026-10-02 发布INFO

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoe...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the

历史摘要 · 未重新核验 · NVD

#cve #cwe-915 #cwe-1321

漏洞预警2026-10-02 发布INFO

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without...

CVE-2026-104849

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-94 #cwe-1321

漏洞预警2026-10-02 发布INFO

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and e...

CVE-2026-104848

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options

历史摘要 · 未重新核验 · NVD

#cve #cwe-1321

安全公告2026-10-02 发布INFO

Tinypool: Prototype Pollution Gadget to RCE in run() options

CVE-2026-104849

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-s

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1321 #cwe-94

安全公告2026-10-02 发布INFO

Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

CVE-2026-104848

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-1321

漏洞预警2026-10-02 发布INFO

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability i...

CVE-2026-94646

Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-248 #cwe-1284 #cwe-1321