CWE-829: Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- n8nn8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook8.8 High
- arksigner software and hardware inc. acbakimzalaLocal File Inclusion in ArkSigner's AcBakImzala9.8 Critical
- truffle security co. trufflehogAn arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co....7.8 High
- hcl myxalyticsHCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.3.1 Low
- ankitects ankiAnkitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary...6.7 Medium
- ibm security verify access docker, security verify access, security verify access appliance +2 more +4 moreIBM Security Verify Access code execution8.5 High
- anysphere cursorCursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config8.8 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions7.7 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters6.5 Medium
- electronElectron is vulnerable to Code Injection via resource modification6.1 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic...6.5 Medium
postgresqlAlmaLinux,libpqopenEuler,matrix-synapseopenSUSE +74 more +76 morePostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client8.8 High- anysphere cursorCursor Agent is vulnerable to prompt injection via MCP Special Files8.6 High
- simple-help simplehelpSimpleHelp Inclusion of functionality from untrusted control sphere8.3 High
- openai codex cliOpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or -...4.1 Medium
- one identity password managerThe Secure Password extension in One Identity Password Manager before 5.14.4 allows local...7.6 High
- rssnext foloFolo allows secrets exfiltration via `pull_request_target`9.1 Critical
- mtrmtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by...7.8 High
- luceeLucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write9.4 Critical
- monero project forumMonero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery10.0 Critical
- sudo, canonical ubuntu linux, debian linux +5 more +7 moreSudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a...9.3 Critical
- niklas portmann azure based remote cache plugin for nx, minio based remote cache plugin for nx, nx remote cache utilities +4 more +6 moreBuild Cache Poisoning via Untrusted Pull Requests9.4 Critical
- nasatheme nasa coreWordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability7.5 High
- elastic agentElastic Agent Inclusion of Functionality from Untrusted Control Sphere4.4 Medium
- cisco webex teamsCisco Webex App Client-Side Remote Code Execution Vulnerability8.8 High
- bandisoft bandizipIn Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This...6.1 Medium
- peazipIn PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability...6.1 Medium
- gnome yelp, debian linux, red hat enterprise linux 6 +33 more +35 moreYelp: arbitrary file read7.4 High
- b&r industrial automation aprolPrivilege escalation in B&R APROL8.5 High
- kedro-org kedro-org/kedroRemote Code Execution in kedro-org/kedro8.8 High
- nhairs python-json-logger, python json logger +1 morePython JSON Logger has a Potential RCE via missing `msgspec-python313-pre` dependency8.8 High
- collaboraonline onlineRemote Code Execution within Collabora Online jail with Macros Enabled6.3 Medium
- printerlogic vasion print, virtual appliance +1 moreVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923...9.8 Critical
- conda-forge conda-forge-metadataRCE in the package conda-forge-metadata9.3 Critical
- cyberchimps responsive addons for elementor, responsive addons for elementor – free elementor addons, kits and elementor templates +1 moreResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion8.8 High
- xen xapi, xen +1 moreXapi: Metadata injection attack against backup/restore functionality3.8 Low
- google application integrationSandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)9.4 Critical
- rezgo, rezgo online booking +1 moreWordPress Rezgo Online Booking plugin <= 4.17 - Local File Inclusion vulnerability8.1 High
- buildapp build app onlineWordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability9.8 Critical
- themify builder, themifyme themify builder +1 moreWordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability6.5 Medium
- synacor zimbra collaboration suiteAn issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and...7.5 High
- magiskThe install() function of ProviderInstaller.java in Magisk App before canary version 27007 does...8.4 High
- buynowdepot advanced online ordering and delivery platformWordPress Advanced Online Ordering and Delivery Platform plugin <= 2.0.0 - Local File Inclusion vulnerability8.1 High
- sciencelogic sl1ScienceLogic SL1 unspecified vulnerability9.3 Critical
- jon vincent mendoza dynamic elementor addonsWordPress Dynamic Elementor Addons plugin <= 1.0.0 - Local File Inclusion vulnerability7.5 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +22 more +24 moreWindows Hyper-V Remote Code Execution Vulnerability8.0 High
- synology drive, drive client +1 moreInclusion of functionality from untrusted control sphere vulnerability in OpenSSL DLL component...7.8 High
- zte zxhn e1600 firmware, zxhn e2603 firmware, zxhn e2615 firmware +7 more +9 moreThe HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init...8.1 High
- gallagher command centre server, command centre +1 moreInclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server...8.0 High
- codection clean loginClean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion8.8 High
- Show moreLoading…