CWE-915
CVEs classified under CWE-915, newest first.
132 CVEsRSS
CVE-2026-29063Critical· 9.8Immutable.js provides many Persistent Immutable data structures
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. …
CVE-2026-25521High· 8.8Locutus brings stdlibs of other programming languages to JavaScript for educational purposes
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitig…
CVE-2025-61781High· 7.1OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation" allows users to delete workspace-related objects such as…
CVE-2025-68109Critical· 9.1PoCChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file …
CVE-2025-66451Medium· 6.5LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). Howev…
CVE-2025-9315NoneAn unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series
An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identified in the MXsecurity Series. An unauthenticated remote attacker can exploit …
CVE-2025-52656High· 7.6HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability
HCL MyXalytics: 6.6. is affected by Mass Assignment vulnerability. Mass Assignment occurs when user input is automatically bound to application objects without proper validation or access controls, potentially allowing unauthorized modi…
CVE-2025-7104High· 7.5A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or data…
CVE-2025-58367CriticalDeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
CVE-2025-24370CriticalDjango-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CVE-2022-2625NoneA vulnerability was found in PostgreSQL
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, a…
CVE-2021-23450High· 7.5All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.