Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS
CVE-2026-73654
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the
#cwe-1321
共收录 238 条相关情报。
← 返回所有主题Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend() utility in ui/src/utils/extend/extend.js recursively c...
CVE-2026-73647
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as...
CVE-2026-73562
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.
Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
CVE-2026-73562
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditiona...
CVE-2026-73088
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow express...
CVE-2026-72769
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An aut
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The node assigns output fields via a dot-notation path setter...
CVE-2026-72749
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields (Set) node. The
`scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution when applying a SCIM PATCH operation whose `value` object contains a key like ...
CVE-2026-48170
CVE-2026-48170 影响 scim-patch 库（用于执行 SCIM PATCH 操作的 Node.js 库），其 0.9.1 之前的版本在应用包含形如 "__proto__.someProp" 键的 value 对象时，会触发
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.ini...
CVE-2026-71438
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vuln...
CVE-2026-71437
Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.
Mermaid configuration APIs allow prototype pollution
CVE-2026-71438
### Summary Mermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteCo
Mermaid Architecture diagrams are vulnerable to prototype pollution
CVE-2026-71437
Rendering an untrusted `architecture-beta` diagram lets the diagram author write an arbitrary property with the value `h
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across...
CVE-2026-70610
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9,
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request...
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth...
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/a
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been p...
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or d...
CVE-2026-67316
axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype h
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js). When a...
CVE-2026-67314
axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/a
axios before 0.33.0 Prototype Pollution via nested option objects
CVE-2026-67319
axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the