Skip to content

Vendor

adaltas vulnerabilities

4 published CVES affecting adaltas, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
1
High
2
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of adaltas alerts

Products

Latest adaltas CVEs

Newest publication first

  1. CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

    Published
    MediumCVSS 6.9 EPSS 0.57%

    node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, ass...

  2. CVE-2026-71243 backmeup (npm) - OS Command Injection via Backup Option Values

    Published
    HighCVSS 8.8 EPSS 0.52%

    The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (loc...

  3. CVE-2021-28860 Prototype Pollution in mixme

    Published
    CriticalCVSS 9.1 EPSS 1.8%

    In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk c...

  4. CVE-2021-23354 Regular Expression Denial of Service (ReDoS)

    Published
    HighCVSS 7.5 EPSS 2.2%

    The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /%(?:(([\w_.]+))|([1-9]\d*)$)?([0 +-]*)(*|\d+)?(.)?(*|\d+)?[hlL]?([%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case ti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.