https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:23:07 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0630 certfr-2024-avi-0630 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0630 https://cve.radiocsirt.org/vuln/euvd-2026-164059 EUVD-2026-164059 https://cve.radiocsirt.org/vuln/euvd-2026-164059 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23436 <p>This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === &#34;__proto__&#34; || p === &#34;constructor&#34;) in applyPatches_ returns false if p is [&#39;__proto__&#39;] (or [&#39;constructor&#39;]). The === operator (strict equality operator) returns false if the operands have different type.</p> <p>This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === &#34;__proto__&#34; || p === &#34;constructor&#34;) in applyPatches_ returns false if p is [&#39;__proto__&#39;] (or [&#39;constructor&#39;]). The === operator (strict equality operator) returns false if the operands have different type.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-23436 https://cve.radiocsirt.org/vuln/ghsa-33f9-j839-rf8h <p><strong>Affected:</strong> npm: immer</p> <p>This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition `(p === &#34;__proto__&#34; || p === &#34;constructor&#34;)` in `applyPatches_` returns false if `p` is `[&#39;__proto__&#39;]` (or `[&#39;constructor&#39;]`). The `===` operator (strict equality operator) returns false if the operands have different type.</p> <p><strong>Affected:</strong> npm: immer</p> <p>This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition `(p === &#34;__proto__&#34; || p === &#34;constructor&#34;)` in `applyPatches_` returns false if `p` is `[&#39;__proto__&#39;]` (or `[&#39;constructor&#39;]`). The `===` operator (strict equality operator) returns false if the operands have different type.</p> https://cve.radiocsirt.org/vuln/ghsa-33f9-j839-rf8h https://cve.radiocsirt.org/vuln/gsd-2021-23436 gsd-2021-23436 https://cve.radiocsirt.org/vuln/gsd-2021-23436 https://cve.radiocsirt.org/vuln/rhsa-2022:6813 <p>chart.js: prototype pollution jackson-databind: denial of service via a large depth of nested objects immer: type confusion vulnerability can lead to a bypass of CVE-2020-28477 minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor parse-url: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor drools: unsafe data deserialization in StreamUtils eventsource: Exposure of Sensitive Information Business-central: Possible XML External Entity Injection attack mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes xerces-j2: infinite loop when handling specially crafted XML document payloads artemis-commons: Apache ActiveMQ Artemis DoS node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery Moment.js: Path traversal in moment.locale postgresql-jdbc: Arbitrary File Write Vulnerability moment: inefficient parsing algorithm resulting in DoS</p> <p>chart.js: prototype pollution jackson-databind: denial of service via a large depth of nested objects immer: type confusion vulnerability can lead to a bypass of CVE-2020-28477 minimist: prototype pollution node-fetch: exposure of sensitive information to an unauthorized actor parse-url: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor drools: unsafe data deserialization in StreamUtils eventsource: Exposure of Sensitive Information Business-central: Possible XML External Entity Injection attack mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors jdbc-postgresql: Unchecked Class Instantiation when providing Plugin Classes xerces-j2: infinite loop when handling specially crafted XML document payloads artemis-commons: Apache ActiveMQ Artemis DoS node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery Moment.js: Path traversal in moment.locale postgresql-jdbc: Arbitrary File Write Vulnerability moment: inefficient parsing algorithm resulting in DoS</p> https://cve.radiocsirt.org/vuln/rhsa-2022:6813