CWE-913: Improper Control of Dynamically-Managed Code Resources
The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
A kind of CWE-664 Improper Control of a Resource Through its Lifetime.
From the CWE List. © The MITRE Corporation.
Newest
- google chrome Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote... 8.8 High
- metalama Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution 7.3 High
- a2ui-project a2ui a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes 5.1 Medium
- gstreamer project gst-editing-services A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can... 7.8 High
- code-projects online reviewer system code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes 5.3 Medium
- agno agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources 6.9 Medium
- ollama Path Traversal leading to Remote Code Execution in Ollama 6.9 Medium
- No product listed Jeebase UserService info updateUser dynamically-determined object attributes 5.3 Medium
- patriksimek vm2 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process 10.0 Critical
- patriksimek vm2 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming 10.0 Critical
- patriksimek vm2 vm2 before 3.11.8 Sandbox Escape via NodeVM 10.0 Critical
- patriksimek vm2 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray 9.3 Critical
- patriksimek vm2 vm2 before 3.11.7 Remote Code Execution via require.external 10.0 Critical
- patriksimek vm2 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector 9.3 Critical
- patriksimek vm2 vm2 NodeVM Remote Code Execution via Array-Shaped Require 9.5 Critical
- functional software, inc. sentry seer Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment 9.8 Critical
- a2ui-project a2ui a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes 5.3 Medium
- ibm mq IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection 7.5 High
- apache nutch Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API) 8.8 High
- apache impala Apache Impala: RCE via External Data Source Class Loading 8.1 High
- eleveo quality management Eleveo Quality Management Conversation events dynamically-determined object attributes 5.3 Medium
- No product listed gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes 5.3 Medium
- spring framework, vmware spring framework +1 more Spring Framework Safety Guard Bypass via SpEL Expression Compilation 9.1 Critical
- basekick-labs arc Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive 8.3 High
- google chrome Improper resource control in Linux Toolkit Theming in Google Chrome prior to 151.0.7922.173... 8.8 High
- lmfit asteval asteval sandbox escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter 5.5 Medium
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 more Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating sa 9.1 Critical
- patriksimek vm2 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators 9.8 Critical
- electerm Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlist 8.8 High
- kidocode crawl4ai Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API 9.8 Critical
- langchain-ai langgraph, langchain langgraph-checkpoint, langchain-ai langraph-checkpoint +2 more LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading 6.8 Medium
- patriksimek vm2 vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass 9.8 Critical
- patriksimek vm2 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE 10.0 Critical
- patriksimek vm2 vm2: Sandbox Breakout Using Promise Species 10.0 Critical
- patriksimek vm2 vm2: Sandbox Escape 10.0 Critical
- lxqt pcmanfm-qt An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's... 9.3 Critical
- mervinpraison praisonai PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection 9.4 Critical
- miyagawa plack::middleware::xsendfile, plack\ +1 more Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting 9.1 Critical
- berriai litellm, red hat lightspeed core, ansible automation platform 2.6 +2 more +4 more Duplicate Advisory: LiteLLM has a sandbox escape in custom-code guardrail 8.8 High
- z-9527 admin z-9527 admin User Update Endpoint user.js dynamically-determined object attributes 5.3 Medium
- No product listed gougucms User Registration Login.php reg_submit dynamically-determined object attributes 5.3 Medium
- nocobase NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node 10.0 Critical
- graphiti Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names 9.1 Critical
- apache airflow providers http Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator 8.8 High
- n8n n8n Has an Expression Escape Vulnerability Leading to RCE 9.4 Critical
- craftercms Improper Control of Dynamically-Managed Code Resources in Crafter Studio 4.5 Medium
- nyariv sandboxjs SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor 10.0 Critical
- patriksimek vm2 vm2 has a Sandbox Escape 9.8 Critical
- signalk signal k server, signalk-server +1 more Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE) 9.7 Critical
- mmaitre314 picklescan picklescan - Remote Code Execution via Unblocked ctypes Module 9.3 Critical
- Show olderLoading…