Export limit exceeded: 12175 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-122234

jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters

jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.annotated.format() can embed script that executes in the application's origin when output is rendered.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Benjamine
Products
Jsondiffpatch
CVE-2026-8657

Prototype Pollution via Unfiltered Delta or JSON Patch Input in jsondiffpatch

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Prototype Pollution via the jsondiffpatch.patch() and jsondiffpatch/formatters/jsonpatch.patch() APIs. An attacker can perform prototype pollution by supplying crafted delta or JSON Patch documents, as attacker-controlled property names and path segments are used to traverse and modify objects without restricting access to special properties like __proto__ or constructor.prototype, allowing modification of Object.prototype.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Benjamine
Products
Jsondiffpatch
CVE-2026-8656

Cross‑Site Scripting via jsondiffpatch Annotated Formatter

Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and property names. If an application compares untrusted JSON/object data and renders annotated formatter output in the DOM, attacker-controlled HTML can be interpreted by the browser, resulting in XSS.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Benjamine
Products
Jsondiffpatch