Merge
Monthly
Weakly protected storage of remote-server credentials in Araxis Merge for Windows (versions 2011.4074 through 2026.0) allows an authenticated, non-administrative local user on the same host to recover and decrypt every credential the target user has saved in the product, because the credentials are kept in the Windows registry without sufficient cryptographic protection (CWE-522). The exposure is local-only (CVSS 4.0 6.8, AV:L/PR:L, confidentiality-only with no integrity or availability impact), so it is a moderate, locally-scoped credential-disclosure issue rather than a remotely exploitable flaw, and its real-world value depends on the attacker already holding an interactive account and on the victim having stored credentials. The issue is not listed in CISA KEV (no confirmed active exploitation); publicly available exploit code exists, and a researcher write-up plus a GitHub repository published under the grepstrength handle accompany the vendor advisory referenced in the CVE record.
Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the merge-viewer endpoint. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Prototype pollution in brikcss merge library versions 1.0 through 1.3.0 enables remote unauthenticated attackers to inject malicious properties into JavaScript Object prototypes via crafted __proto__, constructor.prototype, or prototype arguments, potentially leading to information disclosure, authentication bypass, or denial of service. Publicly available exploit code exists (GitHub PoC from sudo-secure). CVSS 7.3 with network vector and no authentication required. Vendor unresponsive to disclosure attempts.
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
Weakly protected storage of remote-server credentials in Araxis Merge for Windows (versions 2011.4074 through 2026.0) allows an authenticated, non-administrative local user on the same host to recover and decrypt every credential the target user has saved in the product, because the credentials are kept in the Windows registry without sufficient cryptographic protection (CWE-522). The exposure is local-only (CVSS 4.0 6.8, AV:L/PR:L, confidentiality-only with no integrity or availability impact), so it is a moderate, locally-scoped credential-disclosure issue rather than a remotely exploitable flaw, and its real-world value depends on the attacker already holding an interactive account and on the victim having stored credentials. The issue is not listed in CISA KEV (no confirmed active exploitation); publicly available exploit code exists, and a researcher write-up plus a GitHub repository published under the grepstrength handle accompany the vendor advisory referenced in the CVE record.
Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the merge-viewer endpoint. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Prototype pollution in brikcss merge library versions 1.0 through 1.3.0 enables remote unauthenticated attackers to inject malicious properties into JavaScript Object prototypes via crafted __proto__, constructor.prototype, or prototype arguments, potentially leading to information disclosure, authentication bypass, or denial of service. Publicly available exploit code exists (GitHub PoC from sudo-secure). CVSS 7.3 with network vector and no authentication required. Vendor unresponsive to disclosure attempts.
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Samsung and HTC onTouchEvent method implementation for Android on the T-Mobile myTouch 3G Slide, HTC Merge, Sprint EVO Shift 4G, HTC ChaCha, AT&T Status, HTC Desire Z, T-Mobile G2, T-Mobile. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.