primefaces vulnerabilities

Products

• primereact 1

Latest primefaces CVEs

Newest publication first

1. CVE-2026-15538 primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution

   Published 2026-07-13

   Medium·CVSS 5.3 EPSS 0.54%

   A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the file components/lib/utils/ObjectUtils.js of the component API. This manipulation of the argument Field causes improperly controlled modificatio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.