CVE Watch13 jul 2026

CVE-2026-15538

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the com

CVSS

6.3

Medio

EPSS

0.3%

p17

KEV

—

Exploit Today

0-100

Publicado: 13 jul 2026 · Última mod.: 13 jul 2026 · CWE-94 · CWE-1321

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-07-132026-07-20

Descripción técnica

A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-32489.8 CRÍ

100.0%

KEV—80Langflow Missing Authentication Vulnerability6d CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability6d CVE-2026-154107.2 ALT

71.2%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability5d CVE-2025-670389.8 CRÍ

55.4%

KEV—67Lantronix EDS5000 Code Injection Vulnerability15d CVE-2021-416539.8 CRÍ

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.12d CVE-2023-362558.8 ALT

99.0%

——30An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.12d