Skip to content
OpenAdvisories

Weakness (CWE)

CWE-471: Modification of Assumed-Immutable Data (MAID)

Base Draft

The product does not properly protect an assumed-immutable element from being modified by an attacker.

How to prevent it (1 mitigation)

  1. Architecture and Design, Operation, Implementation

    When the data is stored or transmitted through untrusted sources that could modify the data, implement integrity checks to detect unauthorized modification, or store/transmit the data in a trusted location that is free from external influence.

Source: MITRE CWE-471

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.3
    CVE-2026-54610

    LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

    LibreDWG is a free C library to read and write DWG files. Prior to 0.14, `bit_TV_to_utf8()` in `src/bits.c` can write to the caller-provided `src` buffer despite accepting const input. On an `iconv()` error other than `E2BIG`, the function frees its output bu…

    LibreDWG libredwg
  • Low 3.7
    CVE-2026-118780

    Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or s…

    digitalbazaar forge node-forge node-node-forge Ubuntu npm
  • Low 3.7
    CVE-2026-107296

    msgpack5: Decoding negative int64 values mutates the input buffer

    msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the corresponding bytes in the caller-provided input buffer while computing the value. Applications that retain or reuse en…

    mcollina msgpack5 msgpack5 npm
  • Low 3.1
    CVE-2026-59299

    Composition lookup can potentially poison base function in Spring Cloud Function

    Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

    Spring Spring Cloud Function
  • Low 2.7
    CVE-2026-8492

    Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035

    Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.

    Drupal Translate Drupal with GTranslate drupal/gtranslate Web / CMS Packagist
  • Low 3.5
    CVE-2022-3288

    A branch/tag name confusion in GitLab CE/EE affecting all versions prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prio…

    GitLab GitLab gitlab Web / CMS Ubuntu