CWE-471 Modification of Assumed-Immutable Data (MAID)

msgpack5: Decoding negative int64 values mutates the input buffer

vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)

Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

Nautobot: GitRepository.current_head field should not be writable through REST API

justhtml has sanitization bypass in custom policies and programmatic DOM

Multiple security fixes in justhtml

Prototype Pollution in lodash

Neo4j Cypher component mishandles IMMUTABLE privileges

Write to immutable memory region in TensorFlow

Prototype Pollution in immer

Moodle Allows Modification of Constants

Prototype Pollution in defaults-deep

Prototype Pollution in merge-deep

Prototype Pollution in assign-deep

Prototype Pollution in mixin-deep

Prototype Pollution in highlight.js

Google Play Services SDK leads to apps having incorrectly set mutability flag

TypeORM vulnerable to MAID and Prototype Pollution

dot-prop Prototype Pollution vulnerability

Prototype pollution in object-path

Prototype Pollution in handlebars

Prototype Pollution