CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
539 vulnerabilities with CWE-1321
CVE-2026-25881
CRITICAL
sandboxjs < 0.8.31 - Prototype Pollution via Array Literal Taint Bypass
CVSS 9.0
CVE-2026-25754
HIGH
AdonisJS bodyparser < 10.1.3 - Prototype Pollution via Multipart Form-Data Parsing
CVSS 7.2
CVE-2026-25521
HIGH
locutus 2.0.12-2.0.38 - Prototype Pollution via String.prototype
CVSS 8.8
CVE-2026-25150
CRITICAL
Qwik and Qwik City < 1.19.0 - Unauthenticated Prototype Pollution via formToObj Function
CVSS 9.3
CVE-2026-25142
CRITICAL
SandboxJS < 0.8.27 - Prototype Pollution via __lookupGetter__
CVSS 10.0
CVE-2026-25047
HIGH
deephas < 1.0.8 - Prototype Pollution
CVSS 8.8
CVE-2026-24888
MEDIUM
maker.js <= 0.19.1 - Prototype Pollution via makerjs.extendObject
CVSS 6.5
CVE-2026-24766
MEDIUM
NocoDB < 0.301.0 - Authenticated Prototype Pollution via /api/v2/meta/connection/test Endpoint
CVSS 4.9
CVE-2026-23736
HIGH
seroval <1.4.1 - Prototype Pollution
CVSS 7.3
CVE-2026-21854
CRITICAL
Tarkov Data Manager < 2025-01-02 - Unauthenticated Authentication Bypass via Prototype Pollution
CVSS 9.8
CVE-2025-63704
CRITICAL
query-parser-string 1.0.0 - Prototype Pollution
CVSS 9.8
CVE-2025-63703
CRITICAL
parse-ini 1.0.6 - Prototype Pollution
CVSS 9.8
CVE-2025-70956
HIGH
TON Virtual Machine < v2025.04 - State Pollution via Non-Atomic Child VM Initialization
CVSS 7.5
CVE-2025-61140
CRITICAL
dchester/jsonpath 1.1.1 - Prototype Pollution via Value Function
CVSS 9.8
CVE-2025-13465
MEDIUM
lodash 4.0.0-4.17.22 - Prototype Pollution via _.unset and _.omit Functions
CVSS 5.3
CVE-2025-13158
CRITICAL
apidoc-core >=0.2.0 - Prototype Pollution via Malformed Data Structures
CVE-2025-68130
HIGH
tRPC 10.27.0-10.45.2 and 11.0.0-11.7.9 - Prototype Pollution via FormData Field Names
CVE-2025-8083
HIGH
Vuetify 2.2.0-beta.2-3.0.0-alpha.10 - Prototype Pollution via Preset Configuration
CVSS 8.6
CVE-2025-66456
CRITICAL
Elysia <1.4.16 - Prototype Pollution
CVSS 9.8
CVE-2025-13204
HIGH
expr-eval < 2.0.2 - Prototype Pollution via JavaScript Expression Evaluation
CVSS 7.3
CVE-2025-64718
MEDIUM
js-yaml < 3.14.2 and 4.0.0-4.1.1 - Prototype Pollution via __proto__
CVSS 5.3
CVE-2025-62517
MEDIUM
rollbar.js < 2.26.5 and 3.0.0-alpha1-3.0.0-beta5 - Prototype Pollution via merge()
CVSS 5.9
CVE-2025-62410
CRITICAL
happy-dom < 20.0.2 - Prototype Pollution via Incomplete Isolate Protection
CVE-2025-62381
HIGH
sveltekit-superforms < 2.27.4 - Prototype Pollution via parseFormData Function
CVE-2025-62374
MEDIUM
Parse < 7.0.0 - Prototype Pollution via ParseObject.fromJSON
CVSS 6.4
Details
Vulnerabilities
539