CWE-749: Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
A kind of CWE-284 Improper Access Control.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.5 Medium
- webpack-dev-serverwebpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints4.7 Medium
- nrwl nxNx: `nx graph` dev server permissive CORS policy5.9 Medium
- appsmithAppsmith: Caddy admin API exposed without authentication9.9 Critical
- gitroomhq postiz-appPostiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription4.8 Medium
- vitest-dev vitestVitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE9.8 Critical
- @clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 more@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)5.9 Medium
- hepta platforms heptabaseHepta Platforms｜Heptabase - Exposed Dangerous6.9 Medium
- lenovo applicationA vulnerability was identified in the Lenovo Android Application, distributed exclusively on...5.1 Medium
- logseqArbitrary File Read, Write, Rename, and Delete in Logseq8.7 High
- openstack mistral, red hat openstack platform 16.2 +1 moreOpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed9.9 Critical
- home assistant companion app (android), companion app (ios), home-assistant core +2 moreHome Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection8.3 High
- synology c2 identity edge serverAn Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package...7.5 High
- ibm engineering lifecycle managementIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution7.2 High
- penpotPenpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE8.8 High
- @clerk nuxt, nuxt nuxt\/rspack-builder, nuxt\/webpack-builder +2 moreNuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)5.9 Medium
- arqit symmetric key agreement platformArqit SKA-Platform Enables Access to Debug Information5.3 Medium
- arqit symmetric key agreement platformArqit SKA-Platform Vulnerable to Key Exposure8.7 High
- nautobotNautobot: GitRepository.current_head field should not be writable through REST API7.1 High
- fuji electric tellusFuji Electric Tellus Exposed Dangerous Method or Function7.8 High
- ivanti endpoint managerAn exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6...6.5 Medium
- webpack-dev-serverwebpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins5.3 Medium
- github view componentview_component: Preview Route Can Dispatch Inherited Helper Methods6.5 Medium
- qualcomm cologne firmware, fastconnect 6900 firmware, fastconnect 7800 firmware +22 more +24 moreExposed dangerous function in windows host5.5 Medium
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 moreVM2 Sandbox Breakout Through __lookupGetter__9.8 Critical
- gitlabExposed Dangerous Method or Function in GitLab8.5 High
- tandoor recipesTandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users8.1 High
- crewaiCVE-2026-22759.6 Critical
- ivanti desktop and server management, desktop \& server management +1 moreAn exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated...7.8 High
- hackerbay oneuptimeOneUptime Synthetic Monitor RCE via exposed Playwright browser object10.0 Critical
- hackerbay oneuptimeOneUptime Synthetic Monitor RCE via exposed Playwright browser object10.0 Critical
- rustdesk, rustdesk-client rustdesk client +1 moreRustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server9.3 Critical
- mediatek nbiot sdk, mediatek, inc. mediatek chipset +1 moreIn wlan STA driver, there is a possible out of bounds write due to a missing bounds check. This...7.8 High
- docker model-runnerDocker Model Runner Unauthenticated Runtime Flag Injection via _configure Endpoint7.6 High
- opens100 project opens100OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access9.4 Critical
- milvusMilvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise9.8 Critical
- qualcomm ar8035 firmware, fastconnect 6200 firmware, fastconnect 6700 firmware +157 more +159 moreExposed Dangerous Method or Function in HLOS7.1 High
- anoma opencodeOpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution8.8 High
- microsoft playwrightMicrosoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation7.2 High
- n8nSelf-hosted n8n has Legacy Code node that enables arbitrary file read/write7.1 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- realdefense superantispywareRealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability7.8 High
- Show moreLoading…