Most recent entries from all

EUVD-2026-168103

fkie_cve-2021-23518

The package cached-path-relative before 1.1.0 are vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

GHSA-wg6g-ppvx-927h — Prototype Pollution in cached-path-relative

Affected: npm: cached-path-relative

The package cached-path-relative before 1.1.0 is vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573

gsd-2021-23518

RHSA-2022:1476 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

cached-path-relative: Prototype Pollution via the cache variable nanoid: Information disclosure via valueOf() function opencontainers: OCI manifest and index parsing confusion golang.org/x/crypto: empty plaintext packet causes panic nodejs-shelljs: improper privilege management follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path golang: crash in a golang.org/x/crypto/ssh server

UBUNTU-CVE-2021-23518

Affected: Ubuntu:18.04:LTS: node-cached-path-relative, Ubuntu:20.04:LTS: node-cached-path-relative, Ubuntu:22.04:LTS: node-cached-path-relative, Ubuntu:24.04:LTS: node-cached-path-relative, Ubuntu:25.10: node-cached-path-relative, Ubuntu:26.04:LTS: node-cached-path-relative