Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-78180] A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the fun…

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-78181] A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#se…

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem ea…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad Nuevo

Hace 2 horas

[CVE-2026-78178] A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/j…

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-18420] Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards a…

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73654] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 3.3.8 until 4.5.6, the PUT /api/v1/runs/:runId/metadata endpoint passes attacker-controlled operation.key values to new JSONHeroPath(operation.key).set(newMetadata, value) in packages/core/src/v3/runMetadata/operations.ts without rejecting dangerous constructor and prototype path segments. A caller wit…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73088] Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-…

Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist() call, processes untrusted browserslist-stats.json, opts.stats, and CLI --stats data with an unguarded for...in loop and plain-object bracket access and assignment…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-54737] @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash d…

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14893] IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer comp…

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-45325] Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.034…

Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.0340.15, @tmlmobilidade/utils has a prototype pollution vulnerability in setValueAtPath() in packages/utils/src/generic/value-at-path.ts because unsafe path segments are not blocked. This issue is fixed in version 20260509.0340.15.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-48795] AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisj…

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 a…

nvdaltovulnerabilidad CVSS 8.6 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-59206] n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authe…

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated requests to be treated as a privileged user and exposing user and project listing endpoints. This issue is fi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-54639] Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulne…

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an i…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54312] n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with perm…

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rende…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-55388] piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's co…

piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker im…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53676] ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution …

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44494] Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the A…

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-44495] Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1…

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46625] JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-…

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototyp…

nvdaltovulnerabilidad CVSS 7.5 NVD