{"vulnerability": "cve-2026-5473", "sightings": [{"uuid": "a64e1f62-1130-4412-a46c-1085be73fe60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54737", "type": "seen", "source": "https://gist.github.com/alon710/3afa9bbe175e1dfd1649cd2081ad6eb5", "content": "# CVE-2026-54737: CVE-2026-54737: Prototype Pollution in @phun-ky/defaults-deep\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54737\n\n## Summary\nCVE-2026-54737 is a high-severity Prototype Pollution vulnerability in the @phun-ky/defaults-deep npm library prior to version 2.0.5. Due to unsafe recursive object merging, unauthenticated attackers can supply structured payloads that modify the properties of Object.prototype, compromising the runtime process state.\n\n## TL;DR\nA prototype pollution vulnerability in the recursive merging function of @phun-ky/defaults-deep versions prior to 2.0.5 allows remote attackers to execute arbitrary modification of Object.prototype attributes via crafted inputs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1321\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.3 (High)\n- **EPSS Status**: Not Registered\n- **Impact**: Prototype Pollution (Privilege Escalation, DoS, RCE)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js runtime environments using @phun-ky/defaults-deep dependency\n- **@phun-ky/defaults-deep**: < 2.0.5 (Fixed in: `2.0.5`)\n\n## Mitigation\n\n- Upgrade @phun-ky/defaults-deep to version 2.0.5 or above\n- Implement structural deep-sanitization recursive functions on all input middleware\n- Enforce strict prototype freezing at the initialization stage of Node.js services\n\n**Remediation Steps:**\n1. Run npm install @phun-ky/defaults-deep@2.0.5 inside project workspaces\n2. Incorporate input validation schemas such as AJV or Joi to reject properties named __proto__, constructor, and prototype\n3. Deploy custom Express body-parser middleware to strip dangerous keys before merging operations\n\n## References\n\n- [GitHub Security Advisory GHSA-mj3g-7xcc-x4vh](https://github.com/phun-ky/defaults-deep/security/advisories/GHSA-mj3g-7xcc-x4vh)\n- [GitHub Pull Request #49](https://github.com/phun-ky/defaults-deep/pull/49)\n- [Fix Commit 807dba9](https://github.com/phun-ky/defaults-deep/commit/807dba930f8718f9126cad59d949b8fd3539b059)\n- [Release Tag v2.0.5](https://github.com/phun-ky/defaults-deep/releases/tag/2.0.5)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54737) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T18:32:14.083108Z"}, {"uuid": "9ffd35b8-c253-48b7-9af9-a2d8b4b1b308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54733", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqrn26pxli2a", "content": "CVE-2026-54733 - moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint\nCVE ID : CVE-2026-54733\n \n Published : July 16, 2026, 2:52 p.m. | 43\u00a0minutes ago\n \n Description : The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Of...", "creation_timestamp": "2026-07-16T16:15:41.508120Z"}, {"uuid": "6038f412-d296-48ab-a10d-dd04175d9027", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54733", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqrou4dsoi2o", "content": "CVE-2026-54733 - o365-moodle\nThe Moodle Office 365 plugin allows attackers to bypass login verification, gaining access to user accounts. This affects users who rely on Office 365 integration for\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#o365moodle #microsoft #CVE #infosec", "creation_timestamp": "2026-07-16T16:48:04.672582Z"}, {"uuid": "5342957b-8c45-437b-943a-30df4025d1d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54733", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116936433017678779", "content": "It is possible to see elevated activities targeting microsoft o365-moodle (CVE-2026-54733) https://vuldb.com/vuln/379542/cti", "creation_timestamp": "2026-07-17T17:12:45.459468Z"}, {"uuid": "a6cb391a-c63a-4f66-9610-0069d52e9e0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://gist.github.com/alon710/fffec7ff7a3f093df17d5e871ff03c84", "content": "# CVE-2026-54735: CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54735\n\n## Summary\nCVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server's bidder adapters, allowing unauthenticated remote attackers to route HTTP requests to arbitrary locations, including internal local host loopbacks and cloud provider metadata endpoints.\n\n## TL;DR\nPrebid Server versions prior to 4.4.0 fail to validate or sanitize dynamic host and subdomain parameters within several bidder adapters. This allows unauthenticated remote attackers to manipulate the destination of outbound HTTP requests by supplying control characters in OpenRTB requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1**: 10.0 (Critical)\n- **Exploit Status**: Proof of Concept available\n- **CISA KEV Status**: Not listed\n- **Impact**: Server-Side Request Forgery, Local Host Enumeration, Credential Disclosure\n\n## Affected Systems\n\n- Prebid Server\n- **prebid-server**: < 4.4.0 (Fixed in: `4.4.0`)\n\n## Mitigation\n\n- Upgrade to Prebid Server version 4.4.0 or above\n- Configure outbound egress firewalls to block private IP ranges (RFC 1918) and link-local addresses\n- Implement DNS resolution filters inside the container network\n\n**Remediation Steps:**\n1. Identify all active Prebid Server instances and map their respective current versions\n2. Execute upgrade processes to update the prebid-server image or binary to version 4.4.0 or newer\n3. Deploy updated network security policies or firewall rules to limit Prebid Server's outbound egress to public IP endpoints\n4. Verify the mitigation using test payloads matching invalid-host structures\n\n## References\n\n- [GitHub Security Advisory GHSA-4p3g-4hcj-wpvx](https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T16:32:11.749626Z"}, {"uuid": "c91aa657-457d-4824-83ec-1c4b46e476a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrsezo76df2q", "content": "CVE-2026-54735 - prebid\nThe Prebid Server's request handling system can be tricked into sending requests to unauthorized destinations, potentially exposing internal services to malicious actors. This could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#prebid #Golang #CVE #infosec", "creation_timestamp": "2026-07-29T16:50:04.964411Z"}, {"uuid": "b55097ef-79cf-4119-b9a4-69d0f44d81fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsik6jv3n22", "content": "CVE-2026-54735 - prebid-server's request forgery vulnerability allows for possible host environment data extraction\nCVE ID : CVE-2026-54735\n \n Published : July 29, 2026, 4:17 p.m. | 1\u00a0hour, 26\u00a0minutes ago\n \n Description : Prebid Server is an open-source solution for running re...", "creation_timestamp": "2026-07-29T17:53:00.317369Z"}, {"uuid": "5ff1f336-da7b-4337-9adc-4d8c4fb18bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54735", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-54735", "content": "", "creation_timestamp": "2026-07-29T20:15:07.768816Z"}]}