CWE-15

70 vulnerabilities with CWE-15

CVE-2026-46485 HIGH

Dash: Users can write to config despire permissions (OIDC tested)

CVSS 8.2

CVE-2026-44768 MEDIUM

Security misconfiguration in SAP CRM (WebClient UI)

CVSS 4.1

CVE-2026-0418 MEDIUM

Certain NETGEAR devices allow administrators to tamper with system

CVSS 4.5

CVE-2026-46399 CRITICAL

haxtheweb haxcms-nodejs - Authenticated Remote Code Execution via File Overwrite

CVE-2026-1784 HIGH

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

CVSS 8.8

CVE-2026-45087 CRITICAL

Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

CVSS 10.0

CVE-2026-44417 HIGH

Apache CXF JMS Configuration - Remote Code Execution

CVSS 7.5

CVE-2026-44774 CRITICAL

Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

CVSS 9.9

CVE-2026-41489 HIGH

Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks

CVSS 8.8

CVE-2026-43531 HIGH

OpenClaw < 2026.4.9 - Environment Variable Injection via Workspace .env File

CVSS 7.3

CVE-2026-41384 HIGH

OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend

CVSS 7.8

CVE-2026-41176 CRITICAL

Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

CVSS 9.8

CVE-2026-41294 HIGH

OpenClaw < 2026.3.28 - Environment Variable Injection via CWD .env File

CVSS 8.6

CVE-2026-0232 MEDIUM

Cortex XDR Agent: Local Administrator can disable the agent on Windows

CVSS 4.4

CVE-2026-35650 HIGH

OpenClaw < 2026.3.22 - Environment Variable Override Bypass via Inconsistent Sanitization

CVSS 7.5

CVE-2026-33092 HIGH

Acronis True Image < 42902 / OEM < 42571 - Local Privilege Escalation via Environment Variable

CVSS 7.8

CVE-2026-22750 HIGH

SSL bundle configuration silently bypassed in Spring Cloud Gateway

CVSS 7.5

CVE-2026-30817 MEDIUM

Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53

CVSS 5.7

CVE-2026-30816 MEDIUM

Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53

CVSS 5.7

CVE-2026-22177 MEDIUM

OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars

CVSS 6.1

CVE-2026-21422 LOW

Dell PowerScale OneFS 9.10.0-9.12.0 - Privilege Escalation

CVSS 3.4

CVE-2026-27203 HIGH

eBay API MCP Server - Code Injection

CVSS 8.3

CVE-2026-22708 CRITICAL

Cursor < 2.3 - Environment Variable Manipulation via Shell Built-in Execution

CVSS 9.8

CVE-2026-0495 MEDIUM

SAP Fiori App - Privilege Escalation

CVSS 5.1

CVE-2025-13091 MEDIUM

Shopire WordPress Theme <=1.0.57 - Privilege Escalation

CVSS 4.3