CWE-1321: Prototype pollution

CVEs per yearBy the year they were published

1. 20185
2. 201912
3. 202066
4. 202166
5. 202297
6. 202340
7. 202464
8. 202573
9. 2026214

Known exploitedNewest addition to KEV first

• CVE-2026-34621

  Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

  Adobe · Acrobat DC

  ExploitedHigh8.6

Newest CVEs

• CVE-2026-115762

  draw.io: Prototype pollution in GraphML (mxGraphMlCodec)

  jgraph · drawio

  Medium6.1
• CVE-2026-122131

  Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key

  hapijs · joi

  Medium6.3
• CVE-2026-121965

  Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

  parse-community · parse-server

  Medium6.0
• CVE-2026-63402

  i18next: Shared built-in corruption through inherited-key deepExtend recursion

  i18next · i18next

  Medium5.9
• CVE-2026-119569

  Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service

  parse-community · parse-server

  Medium6.0
• CVE-2026-118777

  Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

  digitalbazaar · forge

  Medium4.8
• CVE-2026-118678

  n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction

  n8n-io · n8n

  High7.1
• CVE-2026-118649

  n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

  n8n-io · n8n

  High8.7
• CVE-2026-118250

  Highcharts: dotted series.keys paths write to Object.prototype

  highcharts · highcharts

  High7.2
• CVE-2026-118249

  Highcharts: series column construction writes to Object.prototype

  highcharts · highcharts

  High7.2

Vendors it comes up for most

1. axios18
2. n8n-io16
3. parse-community11
4. Mozilla5
5. cure535
6. highcharts5
7. Adobe4
8. Elastic4
9. apostrophecms4
10. hapijs4