https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-23450.htmlhttps://patchthecve.com/cve/CVE-2021-23450.htmlThu, 08 Oct 2026 22:17:08 +0000HIGH 7.5: All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.https://patchthecve.com/cve/CVE-2020-5258.htmlhttps://patchthecve.com/cve/CVE-2020-5258.htmlThu, 08 Oct 2026 22:17:00 +0000HIGH 7.7: In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. An attacker manipulates these attributes to overwrite, or pollhttps://patchthecve.com/cve/CVE-2018-1000665.htmlhttps://patchthecve.com/cve/CVE-2018-1000665.htmlWed, 17 Jun 2026 01:33:03 +0000MEDIUM 6.1: Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in unit.html and testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/_base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - dehttps://patchthecve.com/cve/CVE-2018-15494.htmlhttps://patchthecve.com/cve/CVE-2018-15494.htmlWed, 17 Jun 2026 01:42:38 +0000CRITICAL 9.8: In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.https://patchthecve.com/cve/CVE-2018-6561.htmlhttps://patchthecve.com/cve/CVE-2018-6561.htmlWed, 17 Jun 2026 02:02:01 +0000MEDIUM 6.1: dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.