Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1321
Weakness type CWE-1321 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 162 | 148 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▃▆█▇█▇
2025-11 0 · 2025-12 0 · 2026-01 2 · 2026-02 0 · 2026-03 3 · 2026-04 6 · 2026-05 8 · 2026-06 20 · 2026-07 30 · 2026-08 26 · 2026-09 29 · 2026-10 24
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-34621 | 8.6 | 82.1 | KEV | Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Pr… |
| CVE-2021-23450 | 9.8 | 98.2 | — | Prototype Pollution |
| CVE-2019-14379 | 9.8 | 94.8 | — | — |
| CVE-2011-10019 | 10.0 | 93.0 | — | Spreecommerce < 0.60.2 Search Parameter RCE |
| CVE-2021-44906 | 9.8 | 91.5 | — | — |
| CVE-2021-23383 | 9.8 | 91.4 | — | Prototype Pollution |
| CVE-2020-5258 | 7.7 | 90.5 | — | Prototype pollution in dojo |
| CVE-2020-7788 | 9.8 | 89.5 | — | Prototype Pollution |
| CVE-2020-7598 | 5.6 | 79.7 | — | — |
| CVE-2025-13465 | 6.9 | 78.4 | — | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions |
| CVE-2026-29063 | 8.7 | 75.5 | — | Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Proto… |
| CVE-2026-33228 | 8.9 | 69.6 | — | flatted: Prototype Pollution via parse() |
| CVE-2020-7639 | 5.3 | 65.0 | — | — |
| CVE-2026-44495 | 7.7 | 63.4 | — | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config… |
| CVE-2026-46625 | 7.5 | 61.7 | — | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute i… |
| CVE-2026-44494 | 8.7 | 60.0 | — | Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| CVE-2026-42033 | 7.4 | 59.7 | — | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request… |
| CVE-2026-61534 | 9.1 | 57.1 | — | Yayson: Prototype pollution in the Store/LegacyStore deserialization |
| CVE-2026-44005 | 10.0 | 56.7 | — | vm2: Sandbox escape |
| CVE-2026-42041 | 6.5 | 56.1 | — | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge S… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| axios | 17 |
| n8n-io | 11 |
| adobe | 4 |
| apache | 3 |
| hapijs | 3 |
| payloadcms | 3 |
| apostrophecms | 2 |
| builderio | 2 |
| cure53 | 2 |
| i18next | 2 |
| lodash | 2 |
| mermaid-js | 2 |
| middleapi | 2 |
| piscinajs | 2 |
| thomaspoignant | 2 |
