CWE-829

Inclusion of Functionality from Untrusted Control Sphere

Parent: CWE-669 - Incorrect Resource Transfer Between Spheres

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

298 vulnerabilities with CWE-829

CVE-2025-36355 HIGH

IBM Security Verify Access <11.0.2 - RCE

CVSS 8.5

CVE-2025-61592 HIGH

Cursor <1.7 - Remote Code Execution

CVSS 8.8

CVE-2025-59828 CRITICAL

Claude Code < 1.0.39 - Missing Authorization via Yarn Plugin Auto-Execution

CVSS 9.8

CVE-2025-59535 MEDIUM

Dnnsoftware Dotnetnuke < 10.1.0 - Information Disclosure

CVSS 6.5

CVE-2025-55305 MEDIUM

Electron <38.0.0-beta.6 - ASAR Integrity Bypass

CVSS 6.1

CVE-2025-57729 MEDIUM

JetBrains IntelliJ IDEA <2025.2 - DoS

CVSS 6.5

CVE-2025-8714 HIGH

PostgreSQL <17.6, <16.10, <15.14, <14.19, <13.22 - Code Injection

CVSS 8.8

CVE-2025-54135 HIGH

Cursor < 1.3.9 - Remote Code Execution via MCP Configuration File Creation

CVSS 8.5

CVE-2025-36727 HIGH

Simplehelp <5.5.12 - Info Disclosure

CVSS 8.3

CVE-2025-54558 MEDIUM

OpenAI Codex CLI <0.9.0 - Code Injection

CVSS 4.1

CVE-2025-27582 HIGH

One Identity Password Manager <5.14.4 - Privilege Escalation

CVSS 7.6

CVE-2025-53546 CRITICAL

Folo - Unauthenticated Remote Code Execution via GitHub Actions pull_request_target

CVSS 9.1

CVE-2025-49809 HIGH

mtr < 0.95 - Untrusted Program Execution via MTR_PACKET Environment Variable

CVSS 7.8

CVE-2025-34074 CRITICAL

Lucee Admin Scheduled Task - Remote CFM File Code Execution

CVE-2025-34060 CRITICAL

Monero Project's Laravel-based forum < - Code Injection

CVE-2025-32463 CRITICAL KEV

Sudo <1.9.17p1 - Privilege Escalation

CVSS 9.3

CVE-2025-36852 CRITICAL

Nx Remote Cache Extensions - Pull Request Cache Poisoning

CVE-2025-39507 HIGH

NasaTheme Nasa Core < 6.4.4 - PHP Local File Inclusion

CVSS 7.5

CVE-2025-20236 HIGH

Cisco Webex App - Unauthenticated Remote Code Execution via Crafted Meeting Invite Link

CVSS 8.8

CVE-2025-33027 MEDIUM

Bandisoft Bandizip <7.37 - Info Disclosure

CVSS 6.1

CVE-2025-33026 MEDIUM

PeaZip < 10.4.0 - Mark-of-the-Web Bypass via Archive Extraction

CVSS 6.1

CVE-2025-27607 HIGH

Python JSON Logger <4 Mar 2025 - RCE

CVSS 8.8

CVE-2025-24796 MEDIUM

Collabora Online <22.05.25, 23.05.1-23.05.18, 24.04.1.1-24.04.12.3 - Arbitrary Binary Execution via Macro

CVE-2025-27668 CRITICAL

Vasion Print < 20.0.1923 and Virtual Appliance < 22.0.843 - Arbitrary Content Inclusion via Iframe

CVSS 9.8

CVE-2025-27510 CRITICAL

conda-forge-metadata <= 0.4.1 - Dependency Confusion Code Execution

Details

Vulnerabilities 298

Links