CWE-829: Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains phpstorm In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment... 4.4 Medium
- jetbrains pycharm In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter... 5.5 Medium
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via... 7.8 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via... 7.0 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent... 3.3 Low
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer... 7.8 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted... 3.6 Low
- jetbrains clion In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation... 9.6 Critical
- jetbrains clion In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson... 9.6 Critical
- johnson controls easyio neo iomanager and tools installer Inclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO... 7.3 High
- jetbrains youtrack In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted... 7.1 High
- jetbrains webstorm In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects... 6.3 Medium
- jetbrains webstorm In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was... 7.8 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via... 3.3 Low
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in... 6.3 Medium
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured... 7.8 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was... 7.8 High
- jetbrains intellij idea In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted... 7.8 High
- jetbrains clion In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a... 7.8 High
- red hat openshift ai (rhoai) Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master 9.1 Critical
- altair-graphql altair, altair-express-middleware, altair-fastify-plugin +2 more +4 more Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox 6.1 Medium
- eosphoros-ai db-gpt eosphoros-ai DB-GPT HuggingFace Adapter hf_adapter.py exec_module inclusion of functionality from untrusted control sphere 6.9 Medium
- myshell-ai ailice myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere 5.3 Medium
- mistralai mistral-vibe Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program 8.6 High
- mistralai mistral-vibe Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers 8.6 High
- i.r.i.s s.a. irispowerscan IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution 6.1 Medium
- christianhelle refitter Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion 7.1 High
- monkeytypegame monkeytype Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN 9.3 Critical
- flexera flexnet publisher FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability 8.6 High
- red hat fuse 7, jboss enterprise application platform 7, jboss enterprise application platform 8.1 +2 more +4 more Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding 7.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.1 +2 more Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization 7.4 High
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8.1 +1 more Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap 8.1 High
- mozilla thunderbird RSS feed could redirect its subscription to a local file or network share 5.7 Medium
- mozilla thunderbird Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment 6.5 Medium
- nvidia tensorrt-llm NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer... 8.4 High
- mistralai mistral-vibe Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree Mode 8.7 High
- internscience internagent InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere 5.3 Medium
- cloudpirates-io helm-charts CloudPirates Open Source Helm Charts: pull_request_target workflow vulnerable to cache poisoning and OIDC token theft 6.9 Medium
- psf black Black: GitHub Action installs unvalidated required-version from pyproject.toml 8.7 High
- bulwarkmail webmail Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into... 8.3 High
- checkmk gmbh checkmk mk-oracle: Local privilege escalation via insecure Oracle Home library loading 5.2 Medium
- vllm vLLM 0.7.3 before 0.31.0 RCE via mm_processor_kwargs.code_revision 9.2 Critical
- argoproj argo-cd Argo CD: A Kustomize Helm config home can run commands in the repo-server 9.9 Critical
- apple xcode This issue was addressed by enforcing library validation on the affected binaries. This issue is... 8.8 High
- apple xcode This issue was addressed by enforcing library validation on the affected binaries. This issue is... 8.8 High
- ivanti connect secure Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache... 7.0 High
- jetbrains junie cli In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP... 7.8 High
- gitea Gitea reusable workflow secret exposure in pull_request_target 8.8 High
- anthropics claude-code Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning 7.5 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 more Microsoft Exchange Server Elevation of Privilege Vulnerability 7.8 High
- Show olderLoading…