Total
382 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-49223 | 1 Naver | 1 Billboard.js | 2025-06-06 | 9.8 Critical |
| billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | ||||
| CVE-2024-34148 | 1 Jenkins | 2 Jenkins, Subversion Partial Release Manager | 2025-06-06 | 6.8 Medium |
| Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier programmatically disables the fix for CVE-2016-3721 whenever a build is triggered from a release tag, by setting the Java system property 'hudson.model.ParametersAction.keepUndefinedParameters'. | ||||
| CVE-2023-46308 | 1 Plotly | 1 Plotly.js | 2025-06-03 | 9.8 Critical |
| In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty. | ||||
| CVE-2023-39296 | 1 Qnap | 2 Qts, Quts Hero | 2025-06-03 | 7.5 High |
| A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later QuTS hero h5.1.3.2578 build 20231110 and later | ||||
| CVE-2025-5150 | 1 Linuxfoundation | 1 Docarray | 2025-06-03 | 6.3 Medium |
| A vulnerability was found in docarray up to 0.40.1. It has been rated as critical. Affected by this issue is the function __getitem__ of the file /docarray/data/torch_dataset.py of the component Web API. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2022-37265 | 1 Stealjs | 1 Steal | 2025-05-28 | 9.8 Critical |
| Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js. | ||||
| CVE-2025-48054 | 2025-05-28 | N/A | ||
| Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attacker can control parts of the path argument to the set function, they could potentially modify the prototype of all objects in the JavaScript runtime, leading to unexpected behavior, denial of service, or even remote code execution in some specific scenarios. This issue has been patched in version 12.5.1. A workaround for this issue involves sanitizing the path argument provided to the set function to ensure that no part of the path string is __proto__, prototype, or constructor. | ||||
| CVE-2020-36604 | 1 Hapijs | 1 Hoek | 2025-05-27 | 8.1 High |
| hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. | ||||
| CVE-2022-21169 | 1 Express Xss Sanitizer Project | 1 Express Xss Sanitizer | 2025-05-21 | 7.3 High |
| The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization. | ||||
| CVE-2022-37614 | 1 Mockery Project | 1 Mockery | 2025-05-15 | 9.8 Critical |
| Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js. | ||||
| CVE-2022-37611 | 1 Gh-pages Project | 1 Gh-pages | 2025-05-15 | 9.8 Critical |
| Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js. | ||||
| CVE-2022-37602 | 1 Grunt-karma Project | 1 Grunt-karma | 2025-05-15 | 9.8 Critical |
| Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js. | ||||
| CVE-2025-3982 | 1 Nortikin | 1 Sverchok | 2025-05-12 | 4.3 Medium |
| A vulnerability, which was classified as problematic, was found in nortikin Sverchok 1.3.0. Affected is the function SvSetPropNodeMK2 of the file sverchok/nodes/object_nodes/getsetprop_mk2.py of the component Set Property Mk2 Node. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2022-37621 | 1 Browserify-shim Project | 1 Browserify-shim | 2025-05-07 | 9.8 Critical |
| Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js. | ||||
| CVE-2025-25014 | 2025-05-07 | 9.1 Critical | ||
| A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. | ||||
| CVE-2022-37623 | 1 Browserify-shim Project | 1 Browserify-shim | 2025-05-06 | 9.8 Critical |
| Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js. | ||||
| CVE-2022-42743 | 1 Deep-parse-json Project | 1 Deep-parse-json | 2025-05-05 | 5.3 Medium |
| deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited. | ||||
| CVE-2022-41714 | 1 Fastest-json-copy Project | 1 Fastest-json-copy | 2025-05-05 | 5.3 Medium |
| fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited. | ||||
| CVE-2022-41713 | 1 Deep-object-diff Project | 1 Deep-object-diff | 2025-05-05 | 5.3 Medium |
| deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the '__proto__' property to be edited. | ||||
| CVE-2024-39001 | 1 Ag-grid | 3 Ag-grid, Ag-grid-enterprise, Ag Charts | 2025-05-01 | 6.3 Medium |
| ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. | ||||