Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (393 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-25953 1 Putil-merge Project 1 Putil-merge 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25952 1 Just-safe-set Project 1 Just-safe-set 2024-11-21 9.8 Critical
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25949 1 Set-getter Project 1 Set-getter 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25948 1 Expand-hash Project 1 Expand-hash 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25947 1 Nestie Project 1 Nestie 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25946 1 Nconf-toml Project 1 Nconf-toml 2024-11-21 9.8 Critical
Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25945 1 Js-extend Project 1 Js-extend 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25944 1 Deep-defaults Project 1 Deep-defaults 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25913 1 Set-or-get Project 1 Set-or-get 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25912 1 Dotty Project 1 Dotty 2024-11-21 9.8 Critical
Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.
CVE-2021-23771 2 Argencoders-notevil Project, Notevil Project 2 Argencoders-notevil, Notevil 2024-11-21 6.5 Medium
This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).
CVE-2021-23760 1 Keyget Project 1 Keyget 2024-11-21 5.6 Medium
The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-28272](https://security.snyk.io/vuln/SNYK-JS-KEYGET-1048048)
CVE-2021-23702 1 Object-extend Project 1 Object-extend 2024-11-21 7.6 High
The package object-extend from 0.0.0 are vulnerable to Prototype Pollution via object-extend.
CVE-2021-23700 1 Merge-deep2 Project 1 Merge-deep2 2024-11-21 6.5 Medium
All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
CVE-2021-23682 2 Appwrite, Litespeed.js Project 2 Appwrite, Litespeed.js 2024-11-21 7.3 High
This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
CVE-2021-23663 1 Sey Project 1 Sey 2024-11-21 6.5 Medium
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
CVE-2021-23597 1 Fastify 1 Fastify-multipart 2024-11-21 7.5 High
This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).
CVE-2021-23594 1 Agoric 1 Realms-shim 2024-11-21 9.8 Critical
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
CVE-2021-23574 1 Js-data 1 Js-data 2024-11-21 7.5 High
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
CVE-2021-23568 1 Eggjs 1 Extend2 2024-11-21 7.3 High
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.