Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Mar 27, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-33994 · Other software · locutusjs · reported by GitHubMedium 6.3
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starting in version 2.0.39 and prior to version 3.0.25, a prototype pollution vulnerability exists in the `parse_str` function of the npm package locutus. An attacker can pollute `Object.prototype` by overriding `RegExp.prototype.test` and then passing a crafted query string to `parse_str`, bypassing the prototype pollution guard. This vulnerability stems from an incomplete fix for CVE-2026-25521. The CVE-2026-25521 patch replaced the `String.prototype.includes()`-based guard with a `RegExp.prototype.test()`-based guard. However, `RegExp.prototype.test` is itself a writable prototype method that can be overridden, making the new guard bypassable in the same way as the original — trading one hijackable built-in for another. Version 3.0.25 contains an updated fix.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-33993 · Other software · locutusjs · reported by GitHubMedium 6.9
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.25, the `unserialize()` function in `locutus/php/var/unserialize` assigns deserialized keys to plain objects via bracket notation without filtering the `__proto__` key. When a PHP serialized payload contains `__proto__` as an array or object key, JavaScript's `__proto__` setter is invoked, replacing the deserialized object's prototype with attacker-controlled content. This enables property injection, for...in propagation of injected properties, and denial of service via built-in method override. This is distinct from the previously reported prototype pollution in `parse_str` (GHSA-f98m-q3hr-p5wq, GHSA-rxrv-835q-v5mh) — `unserialize` is a different function with no mitigation applied. Version 3.0.25 patches the issue.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-32304 · Other software · locutusjs · reported by GitHubCritical 9.8
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function using new Function() in v3.x. This vulnerability is fixed in 3.0.14.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-29091 · Other software · locutusjs · reported by GitHubHigh 8.1
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to version 3.0.0, a remote code execution (RCE) flaw was discovered in the locutus project, specifically within the call_user_func_array function implementation. The vulnerability allows an attacker to inject arbitrary JavaScript code into the application's runtime environment. This issue stems from an insecure implementation of the call_user_func_array function (and its wrapper call_user_func), which fails to properly validate all components of a callback array before passing them to eval(). This issue has been patched in version 3.0.0.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2026Locutus brings stdlibs of other programming languages to JavaScript for educational purposes.CVE-2026-25521 · Other software · locutusjs · reported by GitHubCritical 9.4
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.
- Product
- locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2021The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.CVE-2021-23392 · Other software · Locutus · reported by report@snyk.ioMedium 5.3
The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
- Product
- Locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2020Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.CVE-2020-7719 · Other software · Locutus · reported by report@snyk.ioCritical 9.8
Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.
- Product
- Locutus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2020php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.CVE-2020-13619 · Other software · Locutus · reported by MITRECritical 9.8
php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
- Product
- Locutus PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlocutus.ioreallinkers.github.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.