CWE-471 vulnerabilities

CVE-2026-107296 is a low-severity vulnerability in the msgpack5 library for Node.js and browsers. Before version 6.1.0, decoding a negative signed 64-bit integer causes modification of the input buffer bytes used for decoding. This silent corruption affects applications that reuse or retain the encoded input for integrity checks, logging, or later processing. Positive integers and other MessagePack types are not affected. The issue is fixed in msgpack5 version 6.1.0.

PyJWT versions 2.11.0 through 2.13.0 contain a vulnerability where the decode() and decode_complete() functions mutate a caller-supplied options dictionary when signature verification is disabled. This mutation can cause subsequent calls that enable signature verification to inherit disabled claim checks such as expiration, audience, issuer, and subject verification, allowing acceptance of tokens with invalid claims without raising exceptions. This is a claims verification bypass, not a signature verification bypass. The issue is a regression introduced in March 2025 by a refactor that removed a shallow copy of the options dictionary. The vulnerability requires the application to reuse the same mutable options dictionary across decode calls with different verification intents.

CVE-2026-59299 is a low severity vulnerability in Spring Cloud Function affecting versions 3.2.16 and earlier, 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. It involves a potential modification of assumed-immutable data (CWE-471) where composition lookup can poison the base function. The vulnerability has a CVSS score of 3.1, indicating low impact on confidentiality and integrity, with no impact on availability.

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing. This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.