Vendor
HackerOne
13 known vulnerabilities in products by HackerOne, 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-48714 | i18next i18next-http-middleware: Prototype Pollution | 9.1 | |
| Critical | CVE-2026-48713 | i18next-fs-backend: Prototype pollution via crafted missing-key string | 9.1 | |
| Critical | CVE-2026-41691 | i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns | 9.1 | |
| High | CVE-2026-42353 | i18next i18next-http-middleware: Path Traversal | 8.2 | |
| High | CVE-2026-41683 | HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header | 8.6 | |
| High | CVE-2026-41690 | i18next i18next-http-middleware: Prototype Pollution | 8.6 | |
| Medium | CVE-2017-16010 | HackerOne i18next node module: Cross-site Scripting | 6.1 | |
| High | CVE-2026-41693 | i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite | 8.2 | |
| Medium | CVE-2017-16008 | HackerOne i18next node module: Cross-site Scripting | 6.1 | |
| Low | CVE-2026-105800 | i18next-http-backend incomplete URL validation permits SSRF | 3.7 | |
| Low | CVE-2026-118258 | i18next i18next-http-backend: Injection | 3.7 | |
| Low | CVE-2026-115730 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl | 3.1 | |
| Medium | CVE-2026-41692 | HackerOne I18nextify: Cross-site Scripting | 4.7 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,
Products
| i18next i18next-http-backend | 4 | 0 |
| i18next i18next-http-middleware | 4 | 0 |