https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:21:59.427508+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-01861 bdu:2022-01861 2026-10-04T04:21:59.556010+00:00 bdu:2022-01861 https://cve.radiocsirt.org/vuln/cnvd-2021-67507 cnvd-2021-67507 2026-10-04T04:21:59.556120+00:00 cnvd-2021-67507 https://cve.radiocsirt.org/vuln/euvd-2026-164704 EUVD-2026-164704 2026-10-04T04:21:59.556137+00:00 EUVD-2026-164704 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23434 fkie_cve-2021-23434 2026-10-04T04:21:59.556149+00:00

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

 https://cve.radiocsirt.org/vuln/ghsa-v39p-96qg-c8rf GHSA-v39p-96qg-c8rf — Prototype Pollution in object-path 2026-10-04T04:21:59.556227+00:00

Affected: npm: object-path

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition `currentPath === '__proto__'` returns false if `currentPath` is `['__proto__']`. This is because the `===` operator returns always false when the type of the operands is different.

 https://cve.radiocsirt.org/vuln/gsd-2021-23434 gsd-2021-23434 2026-10-04T04:21:59.556264+00:00 gsd-2021-23434 https://cve.radiocsirt.org/vuln/rhsa-2021:3873 RHSA-2021:3873 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates 2026-10-04T04:21:59.556276+00:00

semver-regex: inefficient regular expression complexity nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name object-path: Type confusion vulnerability can lead to a bypass of CVE-2020-15256 nodejs-set-value: type confusion allows bypass of CVE-2019-10747 redis: Lua scripts can overflow the heap-based Lua stack redis: Integer overflow issue with Streams redis: Integer overflow bug in the ziplist data structure redis: Out of bounds read in lua debugger protocol parser redis: Denial of service via Redis Standard Protocol (RESP) request redis: Integer overflow issue with intsets redis: Integer overflow issue with strings

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-23434 UBUNTU-CVE-2021-23434 2026-10-04T04:21:59.556327+00:00

Affected: Ubuntu:18.04:LTS: node-object-path, Ubuntu:20.04:LTS: node-object-path, Ubuntu:24.04:LTS: node-object-path, Ubuntu:25.10: node-object-path, Ubuntu:26.04:LTS: node-object-path

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.