# CWE-471.

Every Advisory and CVE whose sources give the weakness CWE-471, newest first.

## Records, newest first

- [Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store](https://agentprime.io/advisories/GHSA-4487-j8r4-4g2f.md)
  `GHSA-4487-j8r4-4g2f`, `CVE-2026-118780` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, CWE-471
- [i18next: Shared built-in corruption through inherited-key deepExtend recursion](https://agentprime.io/advisories/CVE-2026-63402.md)
  `CVE-2026-63402` · CVE record: i18next i18next · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Prototype pollution, CWE-471
- [LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling](https://agentprime.io/advisories/CVE-2026-54610.md)
  `CVE-2026-54610` · CVE record: LibreDWG libredwg · CVSS 3.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-471, CWE-703
- [msgpack5: Decoding negative int64 values mutates the input buffer](https://agentprime.io/advisories/GHSA-qw35-55vc-rhgj.md)
  `GHSA-qw35-55vc-rhgj`, `CVE-2026-107296` · npm `msgpack5`: affected `<6.1.0`, fixed in `6.1.0` · CVSS 3.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-471
- [vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor](https://agentprime.io/advisories/GHSA-633r-hq9m-c4ff.md)
  `GHSA-633r-hq9m-c4ff`, `CVE-2026-92949` · npm `vm2`: affected `>=3.9.6, <3.11.7`, fixed in `3.11.7` · CVSS 6.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-471, CWE-693
- [PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse](https://agentprime.io/advisories/GHSA-gvp8-978c-rx2q.md)
  `GHSA-gvp8-978c-rx2q`, `CVE-2026-103001`, `PYSEC-2026-4146` · PyPI `pyjwt`: affected `>=2.11.0, <=2.13.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-471
- [Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor](https://agentprime.io/advisories/GHSA-9f3g-34x8-92jc.md)
  `GHSA-9f3g-34x8-92jc` · npm `vm2`: affected `>=3.9.6, <=3.11.6`, no fixed version yet · CVSS 4.0 Medium · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-471
- [Download of code without integrity check in Jenkins Project Jenkins GitLab Plugin](https://agentprime.io/advisories/CVE-2026-84664.md)
  `CVE-2026-84664` · CVE record: Jenkins Project Jenkins GitLab Plugin · CVSS 5.4 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-471, CWE-494
- [Composition lookup can potentially poison base function in Spring Cloud Function](https://agentprime.io/advisories/CVE-2026-59299.md)
  `CVE-2026-59299` · CVE record: Spring Spring Cloud Function · CVSS 3.1 Low · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-471
- [Azure Active Directory Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-50481.md)
  `CVE-2026-50481` · CVE record: Microsoft Azure Active Directory · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-471
- [DOMPurify: Permanent \`ALLOWED_ATTR\` pollution via \`setConfig()\` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)](https://agentprime.io/advisories/GHSA-cmwh-pvxp-8882.md)
  `GHSA-cmwh-pvxp-8882`, `CVE-2026-65898` · npm `dompurify`: affected `<3.4.11`, fixed in `3.4.11` · CVSS 5.1 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-471, CWE-665
- [Angular Client Hydration DOM Clobbering & Response-Cache Poisoning](https://agentprime.io/advisories/GHSA-rgjc-h3x7-9mwg.md)
  `GHSA-rgjc-h3x7-9mwg`, `CVE-2026-54267` · npm `@angular/core`: affected `<=19.2.25 || >=20.0.0-next.0, <20.3.25 || >=21.0.0-next.0, <21.2.17 || >=22.0.0-next.0, <22.0.1`, fixed in `20.3.25`, `21.2.17`, `22.0.1` · CVSS 8.6 High · Not analysed yet · Published 15 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-471
- [Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035](https://agentprime.io/advisories/CVE-2026-8492.md)
  `CVE-2026-8492` · CVE record: Drupal Translate Drupal with GTranslate · CVSS 2.7 Low · Not analysed yet · Published 19 May 2026 · Tags: CWE-471
- [Nautobot: GitRepository.current_head field should not be writable through REST API](https://agentprime.io/advisories/GHSA-p3hx-pwf3-j8wr.md)
  `GHSA-p3hx-pwf3-j8wr`, `CVE-2026-44798`, `PYSEC-2026-2228` · PyPI `nautobot`: affected `<2.4.33 || >=3.0.0a2, <3.1.2`, fixed in `2.4.33`, `3.1.2` · CVSS 7.1 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-471, CWE-749
- [justhtml has sanitization bypass in custom policies and programmatic DOM](https://agentprime.io/advisories/GHSA-vrx2-77f2-ww34.md)
  `GHSA-vrx2-77f2-ww34`, `CVE-2026-6827` · PyPI `justhtml`: affected `<1.17.0`, fixed in `1.17.0` · CVSS 5.1 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site scripting (XSS), Denial of service, CWE-436, CWE-471
- [Multiple security fixes in justhtml](https://agentprime.io/advisories/GHSA-4p64-v8f5-r2gx.md)
  `GHSA-4p64-v8f5-r2gx`, `CVE-2026-7808` · PyPI `justhtml`: affected `<1.16.0`, fixed in `1.16.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-178, CWE-436
- [An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, \_\_proto\_\_, and Object.assign components.](https://agentprime.io/advisories/CVE-2024-57708.md)
  `CVE-2024-57708` · CVE record · CVSS 5.7 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Denial of service, Broken access control, Prototype pollution, CWE-471
- [IBM Aspera Faspex data modification](https://agentprime.io/advisories/CVE-2025-33136.md)
  `CVE-2025-33136` · CVE record: IBM Aspera Faspex · CVSS 7.1 High · Not analysed yet · Published 22 May 2025 · Tags: CWE-471
- [Application is vulnerable to Privilege escalation](https://agentprime.io/advisories/CVE-2024-9876.md)
  `CVE-2024-9876` · CVE record: ABB ANC and 2 more · CVSS 8.5 High · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-471
- [An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10).](https://agentprime.io/advisories/CVE-2024-55551.md)
  `CVE-2024-55551` · CVE record: Exasol JDBC driver · CVSS 8.3 High · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-471
- [IBM Security Verify Bridge data manipulation](https://agentprime.io/advisories/CVE-2024-45672.md)
  `CVE-2024-45672` · CVE record: IBM Security Verify Bridge · CVSS 6.0 Medium · Not analysed yet · Published 23 Jan 2025 · Tags: CWE-471
- [IBM QRadar WinCollect Agent data manipulation](https://agentprime.io/advisories/CVE-2024-51462.md)
  `CVE-2024-51462` · CVE record: IBM QRadar WinCollect Agent · CVSS 4.0 Medium · Not analysed yet · Published 17 Jan 2025 · Tags: CWE-471
- [Neo4j Cypher component mishandles IMMUTABLE privileges](https://agentprime.io/advisories/GHSA-p343-9qwp-pqxv.md)
  `GHSA-p343-9qwp-pqxv`, `BIT-neo4j-2024-34517`, `BIT-neo4j-enterprise-2024-34517`, `CVE-2024-34517` · Maven `org.neo4j:neo4j-cypher`: affected `>=5.0.0, <5.19.0`, fixed in `5.19.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2024 · Tags: Privilege escalation, CWE-471
- [era-compiler-vyper First Immutable Variable Initialization vulnerability](https://agentprime.io/advisories/CVE-2023-46232.md)
  `CVE-2023-46232` · CVE record: matter-labs era-compiler-vyper · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: CWE-471
- [Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP request…](https://agentprime.io/advisories/CVE-2023-43697.md)
  `CVE-2023-43697` · CVE record: SICK AG APU0200 · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2023 · Tags: CWE-471
- [CVE-2023-2904](https://agentprime.io/advisories/CVE-2023-2904.md)
  `CVE-2023-2904` · CVE record: HID Global SAFE · CVSS 7.3 High · Not analysed yet · Published 7 Jun 2023 · Tags: CWE-471
- [vm2 vulnerable to Arbitrary Code Execution](https://agentprime.io/advisories/GHSA-4w2j-2rg4-5mjw.md)
  `GHSA-4w2j-2rg4-5mjw`, `CVE-2022-25893` · npm `vm2`: affected `<3.9.10`, fixed in `3.9.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Dec 2022 · Tags: Code injection, CWE-471
- [GitLab: A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5…](https://agentprime.io/advisories/CVE-2022-3288.md)
  `CVE-2022-3288` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 17 Oct 2022 · Tags: CWE-471
- [Google Play Services SDK leads to apps having incorrectly set mutability flag](https://agentprime.io/advisories/GHSA-cm6r-892j-jv2g.md)
  `GHSA-cm6r-892j-jv2g`, `CVE-2022-2390` · Maven `com.google.android.gms:play-services-basement`: affected `<18.0.2`, fixed in `18.0.2` · CVSS 6.1 Medium · Not analysed yet · Published 13 Aug 2022 · Tags: CWE-471
- [Crafted backend URLs in Lura Project](https://agentprime.io/advisories/CVE-2022-1561.md)
  `CVE-2022-1561` · CVE record: KrakenD Lura Project and 2 more · CVSS 4.0 Medium · Not analysed yet · Published 1 Aug 2022 · Tags: CWE-471
- [Moodle Allows Modification of Constants](https://agentprime.io/advisories/GHSA-jcrj-gmr6-p5j8.md)
  `GHSA-jcrj-gmr6-p5j8`, `CVE-2011-4301`, `PKSA-ksnr-kdcy-g89c` · Packagist `moodle/moodle`: affected `<1.9.14 || >=2.0, <2.0.5 || >=2.1, <2.1.2`, fixed in `1.9.14`, `2.0.5`, `2.1.2` · No CVSS score · Not analysed yet · Published 13 May 2022 · Tags: CWE-471
- [Node: Due to the formatting logic of the "console.table()" function it was not safe to allow…](https://agentprime.io/advisories/CVE-2022-21824.md)
  `CVE-2022-21824` · CVE record: NodeJS Node · No CVSS score · EPSS 0.22 · Not analysed yet · Published 24 Feb 2022 · Tags: CWE-471
- [A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application.](https://agentprime.io/advisories/CVE-2021-24046.md)
  `CVE-2021-24046` · CVE record: Meta Platforms, Inc Ray-Ban® Stories Smart Glasses · No CVSS score · Not analysed yet · Published 14 Jan 2022 · Tags: CWE-471
- [AzeoTech DAQFactory](https://agentprime.io/advisories/CVE-2021-42701.md)
  `CVE-2021-42701` · CVE record: AzeoTech DAQFactory · CVSS 5.0 Medium · Not analysed yet · Published 5 Nov 2021 · Tags: CWE-471
- [A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).](https://agentprime.io/advisories/CVE-2021-37193.md)
  `CVE-2021-37193` · CVE record: Siemens SINEMA Remote Connect Server · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2021 · Tags: CWE-471
- [A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).](https://agentprime.io/advisories/CVE-2021-37177.md)
  `CVE-2021-37177` · CVE record: Siemens SINEMA Remote Connect Server · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2021 · Tags: CWE-471
- [Prototype pollution in json8-merge-patch](https://agentprime.io/advisories/GHSA-8v9x-9xqg-r8mr.md)
  `GHSA-8v9x-9xqg-r8mr`, `CVE-2020-8268` · npm `json8-merge-patch`: affected `<1.0.3`, fixed in `1.0.3` · CVSS 7.5 High · Not analysed yet · Published 10 May 2021 · Tags: Prototype pollution, CWE-20, CWE-471
- [TypeORM vulnerable to MAID and Prototype Pollution](https://agentprime.io/advisories/GHSA-pf2j-9qmp-jqr2.md)
  `GHSA-pf2j-9qmp-jqr2`, `CVE-2020-8158` · npm `typeorm`: affected `<0.2.25`, fixed in `0.2.25` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2021 · Tags: Prototype pollution, CWE-471
- [Prototype Pollution in immer](https://agentprime.io/advisories/GHSA-9qmh-276g-x5pj.md)
  `GHSA-9qmh-276g-x5pj`, `CVE-2020-28477` · npm `immer`: affected `>=7.0.0, <8.0.1`, fixed in `8.0.1` · CVSS 7.5 High · Not analysed yet · Published 20 Jan 2021 · Tags: CWE-471
- [Write to immutable memory region in TensorFlow](https://agentprime.io/advisories/GHSA-hhvc-g5hv-48c6.md)
  `GHSA-hhvc-g5hv-48c6`, `BIT-tensorflow-2020-26268`, `CVE-2020-26268`, `PYSEC-2020-255`, `PYSEC-2020-299`, `PYSEC-2020-334` · PyPI `tensorflow` and 2 more: affected `<1.15.5 || >=2.0.0, <2.0.4 || >=2.1.0, <2.1.3 || >=2.2.0, <2.2.2 || >=2.3.0, <2.3.2`, fixed in `1.15.5`, `2.0.4`, `2.1.3`, `2.2.2`, `2.3.2` · CVSS 4.4 Medium · Not analysed yet · Published 10 Dec 2020 · Tags: CWE-471
- [Prototype Pollution in systeminformation](https://agentprime.io/advisories/GHSA-4v2w-h9jm-mqjg.md)
  `GHSA-4v2w-h9jm-mqjg`, `CVE-2020-26245` · npm `systeminformation`: affected `<4.30.5`, fixed in `4.30.5` · CVSS 8.1 High · Not analysed yet · Published 27 Nov 2020 · Tags: Command injection, CWE-471
- [Prototype Pollution in highlight.js](https://agentprime.io/advisories/GHSA-vfrc-7r7c-w9mx.md)
  `GHSA-vfrc-7r7c-w9mx`, `CVE-2020-26237` · npm `highlight.js`: affected `<9.18.2 || >=10.0.0, <10.1.2`, fixed in `9.18.2`, `10.1.2` · CVSS 5.8 Medium · Not analysed yet · Published 24 Nov 2020 · Tags: CWE-471
- [Prototype Pollution in json-logic-js](https://agentprime.io/advisories/GHSA-m9hw-7xfv-wqg7.md)
  `GHSA-m9hw-7xfv-wqg7` · npm `json-logic-js`: affected `<2.0.0`, fixed in `2.0.0` · No CVSS score · Not analysed yet · Published 12 Nov 2020 · Tags: CWE-471
- [Prototype pollution in object-path](https://agentprime.io/advisories/GHSA-cwx2-736x-mf6w.md)
  `GHSA-cwx2-736x-mf6w`, `CVE-2020-15256` · npm `object-path`: affected `<0.11.5`, fixed in `0.11.5` · CVSS 7.7 High · Not analysed yet · Published 19 Oct 2020 · Tags: CWE-20, CWE-471
- [Prototype Pollution](https://agentprime.io/advisories/GHSA-6pq3-928q-x6w6.md)
  `GHSA-6pq3-928q-x6w6`, `CVE-2020-8147` · npm `utils-extend`: affected `>=0.0.0`, no fixed version yet · No CVSS score · Not analysed yet · Published 3 Sept 2020 · Tags: CWE-471
- [dot-prop Prototype Pollution vulnerability](https://agentprime.io/advisories/GHSA-ff7x-qrg7-qggm.md)
  `GHSA-ff7x-qrg7-qggm`, `CVE-2020-8116` · npm `dot-prop`: affected `<4.2.1 || >=5.0.0, <5.1.1`, fixed in `4.2.1`, `5.1.1` · CVSS 7.3 High · Not analysed yet · Published 29 Jul 2020 · Tags: Broken access control, Prototype pollution, CWE-471
- [Prototype Pollution in handlebars](https://agentprime.io/advisories/GHSA-q42p-pg8m-cqh6.md)
  `GHSA-q42p-pg8m-cqh6` · npm `handlebars`: affected `<3.0.7 || >=4.0.0, <4.0.14 || >=4.1.0, <4.1.2`, fixed in `3.0.7`, `4.0.14`, `4.1.2` · CVSS 7.3 High · Not analysed yet · Published 5 Jun 2019 · Tags: CWE-471
- [Prototype Pollution in defaults-deep](https://agentprime.io/advisories/GHSA-cqp5-m4pq-gfgp.md)
  `GHSA-cqp5-m4pq-gfgp`, `CVE-2018-3723` · npm `defaults-deep`: affected `<0.2.4`, fixed in `0.2.4` · CVSS 8.8 High · Not analysed yet · Published 26 Jul 2018 · Tags: CWE-471
- [Prototype Pollution in merge-deep](https://agentprime.io/advisories/GHSA-9g9w-hmvj-5h57.md)
  `GHSA-9g9w-hmvj-5h57`, `CVE-2018-3722` · npm `merge-deep`: affected `<3.0.1`, fixed in `3.0.1` · CVSS 8.8 High · Not analysed yet · Published 26 Jul 2018 · Tags: CWE-471
- [Prototype Pollution in lodash](https://agentprime.io/advisories/GHSA-fvqr-27wr-82fm.md)
  `GHSA-fvqr-27wr-82fm`, `CVE-2018-3721` · npm `lodash` and 1 more: affected `<4.17.5`, fixed in `4.17.5` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jul 2018 · Tags: Prototype pollution, CWE-471
- [Prototype Pollution in assign-deep](https://agentprime.io/advisories/GHSA-xcvv-84j5-jw9h.md)
  `GHSA-xcvv-84j5-jw9h`, `CVE-2018-3720` · npm `assign-deep`: affected `<0.4.7`, fixed in `0.4.7` · CVSS 8.8 High · Not analysed yet · Published 26 Jul 2018 · Tags: Prototype pollution, CWE-471
- [Prototype Pollution in mixin-deep](https://agentprime.io/advisories/GHSA-3mpr-hq3p-49h9.md)
  `GHSA-3mpr-hq3p-49h9`, `CVE-2018-3719` · npm `mixin-deep`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 8.8 High · Not analysed yet · Published 26 Jul 2018 · Tags: CWE-20, CWE-471
- [Prototype Pollution in hoek](https://agentprime.io/advisories/GHSA-jp4x-w63m-7wgm.md)
  `GHSA-jp4x-w63m-7wgm`, `CVE-2018-3728` · npm `hoek`: affected `<4.2.1 || >=5.0.0, <5.0.3`, fixed in `4.2.1`, `5.0.3` · CVSS 8.8 High · Not analysed yet · Published 26 Apr 2018 · Tags: Prototype pollution, CWE-471

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-471>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-471/>. Everything for agents: <https://agentprime.io/llms.txt>.