CWE-471.

Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

• Weak cryptography or TLS
• CWE-471

<1.4.1 · fixed in 1.4.1

i18next: Shared built-in corruption through inherited-key deepExtend recursion

• i18next
• Prototype pollution
• CWE-471

LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

• libredwg
• CWE-471
• CWE-703

msgpack5: Decoding negative int64 values mutates the input buffer

• CWE-471

<6.1.0 · fixed in 6.1.0

vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

• CWE-471
• CWE-693

>=3.9.6, <3.11.7 · fixed in 3.11.7

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

• CWE-471

>=2.11.0, <=2.13.0 · no fixed version yet

Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

• CWE-471

>=3.9.6, <=3.11.6 · no fixed version yet

Download of code without integrity check in Jenkins Project Jenkins GitLab Plugin

• Jenkins Project Jenkins GitLab Plugin
• CWE-471
• CWE-494

Composition lookup can potentially poison base function in Spring Cloud Function

• Spring Cloud Function
• CWE-471

Azure Active Directory Elevation of Privilege Vulnerability

• Microsoft Azure Active Directory
• CWE-471

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

• Cross-site scripting (XSS)
• CWE-471

<3.4.11 · fixed in 3.4.11

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

• Cross-site scripting (XSS)
• CWE-471

<=19.2.25 || >=20.0.0-next.0, <20.3.25 || >=21.0.0-next.0, <21.2.17 || >=22.0.0-next.0, <22.0.1 · fixed in 20.3.25, 21.2.17, 22.0.1

Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

• Translate Drupal with GTranslate
• CWE-471

Nautobot: GitRepository.current_head field should not be writable through REST API

• CWE-471
• CWE-749

<2.4.33 || >=3.0.0a2, <3.1.2 · fixed in 2.4.33, 3.1.2

justhtml has sanitization bypass in custom policies and programmatic DOM

• Cross-site scripting (XSS)
• Denial of service

<1.17.0 · fixed in 1.17.0

Multiple security fixes in justhtml

• Cross-site scripting (XSS)
• CWE-20

<1.16.0 · fixed in 1.16.0

An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components.

• Denial of service
• Broken access control

IBM Aspera Faspex data modification

• IBM Aspera Faspex
• CWE-471

Application is vulnerable to Privilege escalation

• ABB ANC
• ABB ANC-L
• CWE-471

An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10).

• Exasol JDBC driver
• CWE-471

IBM Security Verify Bridge data manipulation

• IBM Security Verify Bridge
• CWE-471

IBM QRadar WinCollect Agent data manipulation

• IBM QRadar WinCollect Agent
• CWE-471

Neo4j Cypher component mishandles IMMUTABLE privileges

• Privilege escalation
• CWE-471

>=5.0.0, <5.19.0 · fixed in 5.19.0

era-compiler-vyper First Immutable Variable Initialization vulnerability

• matter-labs era-compiler-vyper
• CWE-471

Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP request…

• SICK AG APU0200
• CWE-471

CVE-2023-2904

• HID Global SAFE
• CWE-471

vm2 vulnerable to Arbitrary Code Execution

• Code injection
• CWE-471

<3.9.10 · fixed in 3.9.10

GitLab: A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5…

• GitLab
• CWE-471

Google Play Services SDK leads to apps having incorrectly set mutability flag

• CWE-471

<18.0.2 · fixed in 18.0.2

Crafted backend URLs in Lura Project

• KrakenD Lura Project
• KrakenD-CE
• CWE-471

Moodle Allows Modification of Constants

• CWE-471

<1.9.14 || >=2.0, <2.0.5 || >=2.1, <2.1.2 · fixed in 1.9.14, 2.0.5, 2.1.2

Node: Due to the formatting logic of the "console.table()" function it was not safe to allow…

• Node
• CWE-471

A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application.

• Meta Platforms, Inc Ray-Ban® Stories Smart Glasses
• CWE-471

AzeoTech DAQFactory

• AzeoTech DAQFactory
• CWE-471

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).

• Siemens SINEMA Remote Connect Server
• CWE-471

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).

• Siemens SINEMA Remote Connect Server
• CWE-471

Prototype pollution in json8-merge-patch

• Prototype pollution
• CWE-20

<1.0.3 · fixed in 1.0.3

TypeORM vulnerable to MAID and Prototype Pollution

• Prototype pollution
• CWE-471

<0.2.25 · fixed in 0.2.25

Prototype Pollution in immer

• CWE-471

>=7.0.0, <8.0.1 · fixed in 8.0.1

Write to immutable memory region in TensorFlow

• CWE-471

<1.15.5 || >=2.0.0, <2.0.4 || >=2.1.0, <2.1.3 || >=2.2.0, <2.2.2 || >=2.3.0, <2.3.2 · fixed in 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2

Prototype Pollution in systeminformation

• Command injection
• CWE-471

<4.30.5 · fixed in 4.30.5

Prototype Pollution in highlight.js

• CWE-471

<9.18.2 || >=10.0.0, <10.1.2 · fixed in 9.18.2, 10.1.2

Prototype Pollution in json-logic-js

• CWE-471

<2.0.0 · fixed in 2.0.0

Prototype pollution in object-path

• CWE-20
• CWE-471

<0.11.5 · fixed in 0.11.5

Prototype Pollution

• CWE-471

>=0.0.0 · no fixed version yet

dot-prop Prototype Pollution vulnerability

• Broken access control
• Prototype pollution

<4.2.1 || >=5.0.0, <5.1.1 · fixed in 4.2.1, 5.1.1

Prototype Pollution in handlebars

• CWE-471

<3.0.7 || >=4.0.0, <4.0.14 || >=4.1.0, <4.1.2 · fixed in 3.0.7, 4.0.14, 4.1.2

Prototype Pollution in defaults-deep

• CWE-471

<0.2.4 · fixed in 0.2.4

Prototype Pollution in merge-deep

• CWE-471

<3.0.1 · fixed in 3.0.1

Prototype Pollution in lodash

• Prototype pollution
• CWE-471

<4.17.5 · fixed in 4.17.5

Prototype Pollution in assign-deep

• Prototype pollution
• CWE-471

<0.4.7 · fixed in 0.4.7

Prototype Pollution in mixin-deep

• CWE-20
• CWE-471

<1.3.1 · fixed in 1.3.1

Prototype Pollution in hoek

• Prototype pollution
• CWE-471

<4.2.1 || >=5.0.0, <5.0.3 · fixed in 4.2.1, 5.0.3