CVE-2026-15195

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. Upgrading to version 15.3.6 will fix this issue. This patch is called a786bc6afc3674f650496472ee93d5cf74c4bd84. It is suggested to upgrade the affected component.

• CWE-94
• CWE-1321

• https://github.com/APIDevTools/json-schema-ref-parser/
• https://github.com/APIDevTools/json-schema-ref-parser/commit/a786bc6afc3674f650496472ee93d5cf74c4bd84
• https://github.com/APIDevTools/json-schema-ref-parser/issues/421
• https://github.com/APIDevTools/json-schema-ref-parser/releases/tag/v15.3.6
• https://vuldb.com/cve/CVE-2026-15195
• https://vuldb.com/submit/851809
• https://vuldb.com/vuln/377123
• https://vuldb.com/vuln/377123/cti
• https://github.com/APIDevTools/json-schema-ref-parser/issues/421

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1519If a BIND resolver is performing DNSSEC validation and encou…7.5
• CVE-2026-15190A vulnerability was detected in SourceCodester Simple and Ni…7.3
• CVE-2026-15191A flaw has been found in mettle sendportal up to 3.0.1. This…6.3
• CVE-2026-15192A vulnerability has been found in mettle sendportal up to 3.…6.5
• CVE-2026-15193A vulnerability was determined in AidanPark openclaw-android…5.3
• CVE-2026-15194A security flaw has been discovered in Open5GS 2.7.7. This a…3.3
• CVE-2026-1520A vulnerability was identified in rethinkdb up to 2.4.3. Aff…2.4
• CVE-2026-15202A security vulnerability has been detected in YzmCMS up to 7…4.3
• CVE-2026-15204A vulnerability was detected in TOTOLINK X5000R 9.1.0cu.2415…5.5
• CVE-2026-15206The SMS Alert WordPress plugin before 3.9.8 does not bind i…7.5
• CVE-2026-15208The RegistrationMagic WordPress plugin before 6.0.9.5 does n…5.3
• CVE-2026-15209The JS Help Desk WordPress plugin before 3.1.5 does not ver…6.5