CVE-2026-78181
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability was identified in ractivejs up to 1.4.4 in the Ractive#set function of the Keypath Handler component. Manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely and the exploit has been made public.
Risk Assessment
The organization may be exposed to remote code execution or modification of application behavior through prototype pollution, potentially leading to privilege escalation or other attacks.
Recommendation
It is recommended to immediately update ractivejs to the latest version if available and monitor security advisories. Until then, restrict trust in input data passed to the Ractive#set function.
Related vulnerabilities
- CVE-2026-76133Critical
The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacker can manipulate or predict the authentication exchange, the weak construction may reduce the assurance provided by the authentication mechanism and facilitate unauthorized access.
- CVE-2026-73819Critical
The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials, potentially preventing legitimate administrators from managing the device.
- CVE-2026-82970Critical
The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (part of WP Legal Pages) has an unrestricted upload of file with dangerous type vulnerability, allowing the use of malicious files. This issue affects versions from n/a through 4.4.1.
- CVE-2026-59111Critical
An OS command injection vulnerability in the eObčanka-Identifikace application (DIA) on MacOS allows an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming URL parameters were passed to the compiled AppleScript wrapper using concatenation without sufficient sanitization.
- CVE-2026-82695Critical
A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- CVE-2026-82694Critical
A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
- CVE-2026-82693Critical
A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-82692Critical
A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
- CVE-2026-82691Critical
A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usb_device.cgi of the component CGI Handler. Such manipulation of the argument f_ups_ip leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
- CVE-2026-82690Critical
A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.
Original NVD description (English source)
A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.