CWE-913

Improper Control of Dynamically-Managed Code Resources

Parent: CWE-664 - Improper Control of a Resource Through its Lifetime

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

90 vulnerabilities with CWE-913
CVE-2026-47210 CRITICAL
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
CVSS 9.8
CVE-2026-47208 CRITICAL
vm2: Sandbox Breakout Using Promise Species
CVSS 10.0
CVE-2026-47137 CRITICAL
vm2 < 3.11.4 - Remote Code Execution via NodeVM Patch Bypass
CVSS 10.0
CVE-2026-47131 CRITICAL
vm2: Sandbox Escape
CVSS 10.0
CVE-2026-48700 CRITICAL
Lxqt PCManFM-Qt < 2.4.0 - Improper Control of Dynamically-Managed Code Resources
CVE-2026-44336 CRITICAL
PraisonAI MCP `tools/call` path-traversal and RCE via Python `.pth` injection
CVSS 9.6
CVE-2026-7381 CRITICAL
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting
CVSS 9.1
CVE-2026-5251 MEDIUM
z-9527 admin User Update Endpoint user.js dynamically-determined object attributes
CVSS 6.3
CVE-2026-5248 MEDIUM
gougucms User Registration Login.php reg_submit dynamically-determined object attributes
CVSS 6.3
CVE-2026-34156 CRITICAL
NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node
CVSS 9.9
CVE-2026-33286 CRITICAL
Graphiti <1.10.2 - Arbitrary Method Execution
CVSS 9.1
CVE-2026-25049 CRITICAL
n8n <1.123.17, <2.5.2 - Command Injection
CVSS 9.9
CVE-2026-1770 MEDIUM
CrafterCMS 4.0.0-4.4.9 - Authenticated Remote Code Execution via Groovy Sandbox Bypass
CVE-2026-23830 CRITICAL
sandboxjs < 0.8.26 - Remote Code Execution via AsyncFunction Constructor Access
CVSS 10.0
CVE-2026-22709 CRITICAL
NPM Vm2 < 3.10.2 - Code Injection
CVSS 9.8
CVE-2025-69219 HIGH
apache-airflow-providers-http < 6.0.0 - Authenticated Remote Code Execution via Crafted Database Entry
CVSS 8.8
CVE-2025-66398 CRITICAL
Signal K Server < 2.19.0 - Unauthenticated Remote Code Execution via Backup Validation Endpoint
CVSS 9.6
CVE-2025-68613 CRITICAL KEV
n8n Workflow Expression Remote Code Execution
CVSS 9.9
CVE-2025-14695 MEDIUM
SamuNatsu HaloBot - Remote Code Execution via HTML Renderer Action Manipulation
CVSS 6.3
CVE-2025-13659 HIGH
Ivanti Endpoint Manager < 2024 SU4 SR1 - Unauthenticated Arbitrary File Write and Remote Code Execution
CVSS 8.8
CVE-2025-13426 HIGH
Google Cloud Apigee hybrid Javacallout policy - Remote Code Execution via Malicious MessageContext Object Injection
CVE-2025-14085 MEDIUM
Youlaitech Youlai-mall 1.0.0/2.0.0 - Improper Control of Dynamicall...
CVSS 6.3
CVE-2025-14051 MEDIUM
Youlaitech Youlai-mall 1.0.0/2.0.0 - Info Disclosure
CVSS 6.3
CVE-2025-54065 HIGH
GZDoom <= 4.14.2 - Remote Code Execution via ZScript Actor State Handling
CVSS 7.9
CVE-2025-26405 MEDIUM
Intel(R) NPU Drivers - Denial of Service via Ring 3 User Applications
CVSS 5.9
Details
Vulnerabilities 90
Links
MITRE CWE Entry Search this CWE With Exploits