orpc

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationCVE-2026-28794middleapi · CVSS 9.3 · 1.1% likely

   CWE-1321

2. oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS BypassCVE-2026-77360middleapi · CVSS 6.3 · 0.5% likely

   CWE-113

3. oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringifyCVE-2026-33331middleapi · CVSS 8.2 · 0.3% likely

   CWE-79

4. @orpc/zod: Prototype injection in smart coercionCVE-2026-103918middleapi · CVSS 6.5 · 0.2% likely

   CWE-1321

5. @orpc/json-schema: Prototype injection in smart coercionCVE-2026-103036middleapi · CVSS 6.5 · 0.2% likely

   CWE-1321

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.