Axios: Nested axios option objects can consume polluted prototype values
## Summary Axios can consume inherited properties from nested request option objects when the JavaScript process alread
#cwe-1321
共收录 238 条相关情报。
← 返回所有主题Axios: Prototype pollution gadgets can alter axios request construction
## Summary axios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been pollut
protobufjs: Text Format string map parsing can mutate returned map object prototype
CVE-2026-59876
## Summary The protobuf.js text format extension parsed string-keyed map entries using ordinary property assignment. A
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was a...
CVE-2026-53592
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in th
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the _.merge(target, source) utility exported by ...
CVE-2026-54335
CVE-2026-54335 影响 Feathersjs 框架（一个用于构建 Web API 和实时应用的 TypeScript/JavaScript 框架）。在版本 5.0.44 及之前，@feathersjs/commons 导出的 _
Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SD...
CVE-2026-48819
Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/pa
A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDepe...
CVE-2026-16008
A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parseP
sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution
CVE-2026-16008
A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parseP
Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValu...
CVE-2026-45325
Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade
Gestor de Oferta: Prototype pollution in @tmlmobilidade/utils setValueAtPath
CVE-2026-45325
Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field...
CVE-2026-48795
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompl
Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser
CVE-2026-48795
AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompl
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attri...
CVE-2026-49459
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(roo
DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
CVE-2026-49459
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(roo
Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
CVE-2026-54335
### Impact The `_.merge(target, source)` utility exported by `@feathersjs/commons` recursively merges `source` into `ta
A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file code/core/web/src/config.ts. Such manipulation leads to imp...
CVE-2026-15702
A security vulnerability has been detected in tamagui up to 2.3.0. This affects the function updateConfig of the file co
A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a man...
CVE-2026-15697
A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/
A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Pa...
CVE-2026-15607
CVE-2026-15607 是影响 tanstack db（一种数据库库）的一个原型污染漏洞，涉及版本 0.6.8 及之前的所有版本。该漏洞位于文件 src/query/compiler/select.ts 中的 select 函数，属于
tanstack db Alias Path select.ts select prototype pollution
CVE-2026-15607
A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the fi
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path ca...
CVE-2026-15598
A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/ob