CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Payload authentication token field handling issue

Payload: Field-level write access bypass in Payload on MongoDB

@orpc/zod: Prototype injection in smart coercion

Prototype Pollution via parse() in NodeJS flatted

locutus is vulnerable to Prototype Pollution

jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)

scim-patch: Mutation of Inherited Built-in Method Objects

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)

Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements