CVE WatchJul 18, 2026

CVE-2026-16150

A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/ext

CVSS

6.3

Medium

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Published: Jul 18, 2026 · Last modified: Jul 18, 2026 · CWE-94 · CWE-1321

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component Internal Deep Merge Helper. The manipulation results in improperly controlled modification of object prototype attributes. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability5d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability5d CVE-2026-154107.2 HIG

71.1%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability4d CVE-2025-670389.8 CRI

55.3%

KEV—67Lantronix EDS5000 Code Injection Vulnerability14d CVE-2021-416539.8 CRI

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.11d CVE-2023-362558.8 HIG

99.0%

——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.11d