CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
539 vulnerabilities with CWE-1321
CVE-2026-35209
HIGH
defu: Prototype pollution via `__proto__` key in defaults argument
CVSS 7.5
CVE-2026-2950
MEDIUM
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
CVSS 6.5
CVE-2026-34221
CRITICAL
MikroORM has Prototype Pollution in Utils.merge
CVSS 9.1
CVE-2026-33994
CRITICAL
Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521
CVSS 9.8
CVE-2026-33993
CRITICAL
Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()
CVSS 9.8
CVE-2026-33916
MEDIUM
Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection
CVSS 4.7
CVE-2026-33672
MEDIUM
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
CVSS 5.3
CVE-2026-33696
HIGH
n8n Vulnerable to Prototype Pollution in XML & GSuiteAdmin node parameters lead to RCE
CVSS 8.8
CVE-2026-33228
CRITICAL
flatted: Prototype Pollution via parse()
CVSS 9.8
CVE-2026-32701
HIGH
Qwik has array method pollution in FormData processing, allowing type confusion and DoS
CVSS 7.5
CVE-2026-32886
HIGH
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
CVSS 7.5
CVE-2026-32878
HIGH
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
CVSS 7.5
CVE-2026-31865
MEDIUM
Elysia Cookie Value Prototype Pollution
CVSS 6.5
CVE-2026-27524
MEDIUM
OpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path
CVSS 4.3
CVE-2026-4239
LOW
Lagom WHMCS Template Datatables prototype pollution
CVSS 3.5
CVE-2026-32621
CRITICAL
Apollo Federation has prototype pollution via incomplete key sanitization
CVSS 9.9
CVE-2026-30226
HIGH
Svelte devalue <=5.6.3 - Deserialization
CVSS 7.5
CVE-2026-30939
HIGH
Parse Server <8.6.13/9.5.1-alpha.2 - DoS
CVSS 7.5
CVE-2026-29063
CRITICAL
Immutable.js <3.8.3/4.3.7/5.1.5 - Prototype Pollution
CVSS 9.8
CVE-2026-28794
CRITICAL
@orpc/client <1.13.6 - Deserialization
CVSS 9.8
CVE-2026-30785
MEDIUM
rustdesk < 1.4.5 - Prototype Pollution and Insufficient Password Hash Effort
CVSS 5.5
CVE-2026-27837
MEDIUM
Dottie 2.0.4-2.0.6 - Prototype Pollution
CVSS 6.3
CVE-2026-2964
MEDIUM
higuma web-audio-recorder-js 0.1/0.1.1 - Prototype Pollution
CVSS 5.0
CVE-2026-27212
HIGH
Swiper 6.5.1-12.1.1 - Prototype Pollution
CVSS 7.8
CVE-2026-26021
CRITICAL
set-in 2.0.1-2.0.4 - Prototype Pollution via Array.prototype
CVSS 9.8
Details
Vulnerabilities
539