CWE-471 · Other weaknesses
Modification of Assumed-Immutable Data (MAID)
38CVEs
0exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
38 CVEs with CWE-471 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-21824Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passin…NodeJS · Node · 2022-02-24 | – | 22% | 2022-02-24 |
| CVE-2018-3728hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which…hapi · hoek node module · 2018-03-30 | – | 4.2% | 2018-03-30 |
| CVE-2020-8147Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service o…Utils-Extend Project · utils-extend · 2020-04-03 | – | 3.1% | 2020-04-03 |
| CVE-2020-8116Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language…Dot-Prop Project · dot-prop · 2020-02-04 | – | 3.1% | 2020-02-04 |
| CVE-2018-3721lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malici…HackerOne · lodash node module · 2018-06-07 | – | 2.3% | 2018-06-07 |
| CVE-2020-8158Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection atta…Typeorm · typeorm · 2020-09-18 | – | 2.1% | 2020-09-18 |
| CVE-2018-3719mixin-deep node module before 1.3.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" v…HackerOne · mixin-deep node module · 2018-06-07 | – | 2.1% | 2018-06-07 |
| CVE-2018-3723defaults-deep node module before 0.2.4 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object…HackerOne · defaults-deep node module · 2018-06-07 | – | 2.0% | 2018-06-07 |
| CVE-2018-3722merge-deep node module before 3.0.1 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object" v…HackerOne · merge-deep node module · 2018-06-07 | – | 2.0% | 2018-06-07 |
| CVE-2018-3720assign-deep node module before 0.4.7 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability, which allows a malicious user to modify the prototype of "Object"…HackerOne · assign-deep node module · 2018-06-07 | – | 2.0% | 2018-06-07 |
| CVE-2020-15256Prototype pollution in object-pathmariocasciaro · object-path · CVSS 7.7 · 2020-10-19 | 7.7 | 1.5% | 2020-10-19 |
| CVE-2022-25893Arbitrary Code ExecutionVm2 Project · vm2 · CVSS 9.8 · 2022-12-21 | 9.8 | 1.5% | 2022-12-21 |
| CVE-2020-26237Prototype Pollution in highlight.jshighlightjs · highlight.js · CVSS 5.8 · 2020-11-24 | 5.8 | 1.3% | 2020-11-24 |
| CVE-2020-8268Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.Json8-Merge-Patch Project · json8-merge-patch · 2020-11-09 | – | 1.3% | 2020-11-09 |
| CVE-2023-43697Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file path…SICK AG · APU0200 · CVSS 6.5 · 2023-10-09 | 6.5 | 0.9% | 2023-10-09 |
| CVE-2022-3288A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 allows an attacker to manipulate pages where the…GitLab · GitLab · CVSS 3.5 · 2022-10-17 | 3.5 | 0.8% | 2022-10-17 |
| CVE-2026-50481Azure Active Directory Elevation of Privilege VulnerabilityMicrosoft · Azure Active Directory · CVSS 9.9 · 2026-08-06 | 9.9 | 0.8% | 2026-08-06 |
| CVE-2021-24046A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebook View application. This issue affecte…Meta Platforms, Inc · Ray-Ban® Stories Smart Glasses · 2022-01-14 | – | 0.7% | 2022-01-14 |
| CVE-2023-46232era-compiler-vyper First Immutable Variable Initialization vulnerabilitymatter-labs · era-compiler-vyper · CVSS 5.3 · 2023-10-25 | 5.3 | 0.7% | 2023-10-25 |
| CVE-2024-55551An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process…Exasol · JDBC driver · CVSS 8.3 · 2025-03-19 | 8.3 | 0.6% | 2025-03-19 |
| CVE-2024-34517The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access.Neo4j · Neo4j · CVSS 6.5 · 2024-05-07 | 6.5 | 0.6% | 2024-05-07 |
| CVE-2021-42701AzeoTech DAQFactoryAzeoTech · DAQFactory · CVSS 5 · 2021-11-05 | 5.0 | 0.6% | 2021-11-05 |
| CVE-2022-1561Crafted backend URLs in Lura ProjectKrakenD · Lura Project · CVSS 4 · 2022-08-01 | 4.0 | 0.6% | 2022-08-01 |
| CVE-2023-2904CVE-2023-2904HID Global · SAFE · CVSS 7.3 · 2023-06-07 | 7.3 | 0.6% | 2023-06-07 |
| CVE-2021-37177A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by the syslog clients managed by the affected software can be ma…Siemens · SINEMA Remote Connect Server · CVSS 6.5 · 2021-09-14 | 6.5 | 0.4% | 2021-09-14 |
| CVE-2024-51462IBM QRadar WinCollect Agent data manipulationIBM · QRadar WinCollect Agent · CVSS 4 · 2025-01-17 | 4.0 | 0.4% | 2025-01-17 |
| CVE-2021-37193A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attacker in the same network of the affected system could manipul…Siemens · SINEMA Remote Connect Server · CVSS 4.3 · 2021-09-14 | 4.3 | 0.4% | 2021-09-14 |
| CVE-2025-33136IBM Aspera Faspex data modificationIBM · Aspera Faspex · CVSS 7.1 · 2025-05-22 | 7.1 | 0.4% | 2025-05-22 |
| CVE-2026-92949vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptorpatriksimek · vm2 · CVSS 4 · 2026-09-17 | 4.0 | 0.3% | 2026-09-17 |
| CVE-2026-107296msgpack5: Decoding negative int64 values mutates the input buffermcollina · msgpack5 · CVSS 3.7 · 2026-10-08 | 3.7 | 0.3% | 2026-10-08 |
| CVE-2026-103001PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reusejpadilla · pyjwt · CVSS 6.5 · 2026-09-30 | 6.5 | 0.3% | 2026-09-30 |
| CVE-2024-9876Application is vulnerable to Privilege escalationABB · ANC · CVSS 7.3 · 2025-04-30 | 7.3 | 0.2% | 2025-04-30 |
| CVE-2026-8492Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035Drupal · Translate Drupal with GTranslate · CVSS 2.7 · 2026-05-19 | 2.7 | 0.2% | 2026-05-19 |
| CVE-2020-26268Write to immutable memory region in TensorFlowtensorflow · tensorflow · CVSS 4.4 · 2020-12-10 | 4.4 | 0.2% | 2020-12-10 |
| CVE-2026-59299Composition lookup can potentially poison base function in Spring Cloud FunctionSpring · Spring Cloud Function · CVSS 3.1 · 2026-08-27 | 3.1 | 0.2% | 2026-08-27 |
| CVE-2024-45672IBM Security Verify Bridge data manipulationIBM · Security Verify Bridge · CVSS 6 · 2025-01-23 | 6.0 | 0.1% | 2025-01-23 |
| CVE-2026-54610LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handlingLibreDWG · libredwg · CVSS 3.3 · 2026-10-30 | 3.3 | 0.1% | 2026-10-30 |
| CVE-2022-2390Mutable pending intent in Google Play services SDKGoogle LLC · Play Services SDK · CVSS 6.1 · 2022-08-12 | 6.1 | 0.1% | 2022-08-12 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.