https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:30:12 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0424 certfr-2026-avi-0424 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0424 https://cve.radiocsirt.org/vuln/euvd-2026-270458 EUVD-2026-270458 https://cve.radiocsirt.org/vuln/euvd-2026-270458 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27212 <p>Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.</p> <p>Swiper is a free and mobile touch slider with hardware accelerated transitions and native behavior. Versions 6.5.1 through 12.1.1 have a Prototype pollution vulnerability. The vulnerability resides in line 94 of shared/utils.mjs, where the indexOf() function is used to check whether user provided input contain forbidden strings. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. Any application that processes attacker-controlled input using this package may be affected by the following: Authentication Bypass, Denial of Service and RCE. This issue is fixed in version 12.1.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27212 https://cve.radiocsirt.org/vuln/ghsa-hmx5-qpq5-p643 <p><strong>Affected:</strong> npm: swiper</p> <p>### Summary A prototype pollution vulnerability exists in the the npm package swiper (&gt;=6.5.1, &lt; 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2</p> <p>### Details The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC #### Steps to reproduce 1. Install latest version of swiper using npm install 2. Run the following code snippet: ```javascript var swiper = require(&#39;swiper&#39;); Array.prototype.indexOf = () =&gt; -1; let obj = {}; var malicious_payload = &#39;{&#34;__proto__&#34;:{&#34;polluted&#34;:&#34;yes&#34;}}&#39;; console.log({}.polluted); swiper.default.extendDefaults(JSON.parse(malicious_payload)); console.log({}.polluted); // prints yes -&gt; indicating that the patch was bypassed and prototype pollution occurred ```</p> <p>#### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a prototype pollution vulnerability, which can have severe security implications dep…</p> <p><strong>Affected:</strong> npm: swiper</p> <p>### Summary A prototype pollution vulnerability exists in the the npm package swiper (&gt;=6.5.1, &lt; 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2</p> <p>### Details The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.</p> <p>### PoC #### Steps to reproduce 1. Install latest version of swiper using npm install 2. Run the following code snippet: ```javascript var swiper = require(&#39;swiper&#39;); Array.prototype.indexOf = () =&gt; -1; let obj = {}; var malicious_payload = &#39;{&#34;__proto__&#34;:{&#34;polluted&#34;:&#34;yes&#34;}}&#39;; console.log({}.polluted); swiper.default.extendDefaults(JSON.parse(malicious_payload)); console.log({}.polluted); // prints yes -&gt; indicating that the patch was bypassed and prototype pollution occurred ```</p> <p>#### Expected behavior Prototype pollution should be prevented and {} should not gain new properties. This should be printed on the console: ``` undefined undefined OR throw an Error ```</p> <p>#### Actual behavior Object.prototype is polluted This is printed on the console: ``` undefined yes ```</p> <p>### Impact This is a prototype pollution vulnerability, which can have severe security implications dep…</p> https://cve.radiocsirt.org/vuln/ghsa-hmx5-qpq5-p643 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3046 <p>Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3046