https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T21:59:17.571055+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-226390 EUVD-2026-226390 2026-10-03T21:59:17.632520+00:00 EUVD-2026-226390 https://cve.radiocsirt.org/vuln/fkie_cve-2023-22579 fkie_cve-2023-22579 2026-10-03T21:59:17.632556+00:00

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

 https://cve.radiocsirt.org/vuln/ghsa-vqfx-gj96-3w95 GHSA-vqfx-gj96-3w95 — Unsafe fall-through in getWhereConditions 2026-10-03T21:59:17.632589+00:00

Affected: npm: sequelize, npm: @sequelize/core

### Impact

Providing an invalid value to the `where` option of a query caused Sequelize to ignore that option instead of throwing an error.

A finder call like the following did not throw an error:

```ts User.findAll({ where: new Date(), }); ```

As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.

### Patches

This issue has been patched in [`sequelize@6.28.1`](https://github.com/sequelize/sequelize/pull/15699) & [`@sequelize/core@7.0.0.alpha-20`](https://github.com/sequelize/sequelize/pull/15375)

### References

A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698

CVE: CVE-2023-22579 Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090

 https://cve.radiocsirt.org/vuln/gsd-2023-22579 gsd-2023-22579 2026-10-03T21:59:17.632627+00:00 gsd-2023-22579