Threat database

CVE-2026-45325 is a prototype pollution vulnerability in the tmlmobilidade go package, specifically in the setValueAtPath() function of @tmlmobilidade/utils. Versions prior to 20260509.0340.15 are affected due to unsafe handling of path segments. This vulnerability allows improper modification of object prototype attributes, which can lead to integrity issues. The vulnerability is fixed in version 20260509.0340.15. It has a high severity with a CVSS score of 8.2.

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it.