https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 14:41:06 +0000 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0145 https://cve.radiocsirt.org/vuln/euvd-2026-8796 EUVD-2026-8796 https://cve.radiocsirt.org/vuln/euvd-2026-8796 https://cve.radiocsirt.org/vuln/fkie_cve-2023-36665 <p>&#34;protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.</p> <p>&#34;protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-36665 https://cve.radiocsirt.org/vuln/ghsa-h755-8qp9-cq85 <p><strong>Affected:</strong> npm: protobufjs</p> <p>protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about `Object.constructor.prototype.&lt;new-property&gt; = ...;` whereas CVE-2022-25878 was about `Object.__proto__.&lt;new-property&gt; = ...;` instead.</p> <p><strong>Affected:</strong> npm: protobufjs</p> <p>protobuf.js (aka protobufjs) 6.10.0 until 6.11.4 and 7.0.0 until 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about `Object.constructor.prototype.&lt;new-property&gt; = ...;` whereas CVE-2022-25878 was about `Object.__proto__.&lt;new-property&gt; = ...;` instead.</p> https://cve.radiocsirt.org/vuln/ghsa-h755-8qp9-cq85 https://cve.radiocsirt.org/vuln/gsd-2023-36665 gsd-2023-36665 https://cve.radiocsirt.org/vuln/gsd-2023-36665