feathersjs records
9 published records for vendor feathersjs.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-287 Improper Authentication1
- CWE-346 Origin Validation Error1
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')1
- CWE-754 Improper Check for Unusual or Exceptional Conditions1
The weakness classes this vendor ships most often: where to look.
CWEAll records
9 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2022-29823No exploit | Feathers - Query “__proto__” is converted to real prototypefeathersjs · feathers-sequelize · CWE-1321 | Critical9.8 | — | 1.5% | Oct 26, 2022 |
39Monitor | CVE-2022-29822No exploit | Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injectionfeathersjs · feathers-sequelize · CWE-89 | Critical9.8 | — | 0.8% | Oct 26, 2022 |
39Monitor | CVE-2022-2422No exploit | Feathers - SQL injection via attribute aliasesfeathersjs · feathers-sequelize · CWE-89 | Critical9.8 | — | 0.8% | Oct 26, 2022 |
37Monitor | CVE-2026-29792No exploit | Feathersjs has an OAuth Callback Account Takeoverfeathersjs · feathers · CWE-287 | Critical9.3 | — | 0.7% | Mar 10, 2026 |
37Monitor | CVE-2026-29793No exploit | NoSQL Injection via WebSocket id Parameter in MongoDB Adapterfeathersjs · feathers · CWE-943 | Critical9.3 | — | 0.6% | Mar 10, 2026 |
32Monitor | CVE-2026-27193No exploit | Feathers exposes internal headers via unencrypted session cookiefeathersjs · feathers · CWE-200 | High8.2 | — | 0.4% | Feb 21, 2026 |
30Monitor | CVE-2023-37899No exploit | feathersjs socket handler allows abusing implicit toStringfeathersjs · feathers · CWE-754 | High7.5 | — | 1.2% | Jul 19, 2023 |
30Monitor | CVE-2026-27192No exploit | Feathers has an origin validation bypass via prefix matchingfeathersjs · feathers · CWE-346 | High7.6 | — | 0.3% | Feb 21, 2026 |
29Monitor | CVE-2026-27191No exploit | Feathers: Open Redirect in OAuth callback enables account takeoverfeathersjs · feathers · CWE-601 | High7.4 | — | 0.3% | Feb 21, 2026 |
- CVE-2022-2982339Monitor
Feathers - Query “__proto__” is converted to real prototype
CriticalCVSS 9.8No exploitEPSS 2%feathersjs · feathers-sequelizeOct 26, 2022
- CVE-2022-2982239Monitor
Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection
CriticalCVSS 9.8No exploitEPSS 1%feathersjs · feathers-sequelizeOct 26, 2022
- CVE-2022-242239Monitor
Feathers - SQL injection via attribute aliases
CriticalCVSS 9.8No exploitEPSS 1%feathersjs · feathers-sequelizeOct 26, 2022
- CVE-2026-2979237Monitor
Feathersjs has an OAuth Callback Account Takeover
CriticalCVSS 9.3No exploitEPSS 1%feathersjs · feathersMar 10, 2026
- CVE-2026-2979337Monitor
NoSQL Injection via WebSocket id Parameter in MongoDB Adapter
CriticalCVSS 9.3No exploitEPSS 1%feathersjs · feathersMar 10, 2026
- CVE-2026-2719332Monitor
Feathers exposes internal headers via unencrypted session cookie
HighCVSS 8.2No exploitEPSS 0%feathersjs · feathersFeb 21, 2026
- CVE-2023-3789930Monitor
feathersjs socket handler allows abusing implicit toString
HighCVSS 7.5No exploitEPSS 1%feathersjs · feathersJul 19, 2023
- CVE-2026-2719230Monitor
Feathers has an origin validation bypass via prefix matching
HighCVSS 7.6No exploitEPSS 0%feathersjs · feathersFeb 21, 2026
- CVE-2026-2719129Monitor
Feathers: Open Redirect in OAuth callback enables account takeover
HighCVSS 7.4No exploitEPSS 0%feathersjs · feathersFeb 21, 2026