confetti vulnerabilities

Products

• yayson 1

Latest confetti CVEs

Newest publication first

1. CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

   Published 2026-09-14

   Critical·CVSS 9.1 EPSS 0.84%

   Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A docu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.