CWE-183
41 CVEs classified under CWE-183. Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3490 | Critical | 10.0 | 2026-06-17 | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indi… |
CVE-2026-54316 | Critical | 9.1 | 2026-06-23 | Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch too… |
CVE-2026-29514 | High | 8.8 | 2026-05-04 | NetBox versions 4.3.5 through 4.5.4 contain a remote code execution vulnerability in the RenderTemplateMixin.get_environment_params() method that allows authen… |
CVE-2025-53762 | High | 8.7 | 2025-07-18 | Permissive list of allowed inputs in Microsoft Purview allows an authorized attacker to elevate privileges over a network. |
CVE-2026-59802 | High | 8.2 | 2026-07-08 | PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can create malici… |
CVE-2026-33979 | High | 8.2 | 2026-03-27 | Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross S… |
CVE-2026-41387 | High | 7.8 | 2026-04-28 | OpenClaw before 2026.3.22 contains an incomplete host environment variable sanitization vulnerability in host-env-security-policy.json and host-env-security.ts… |
CVE-2025-59457 | High | 7.7 | 2025-09-17 | In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows |
CVE-2020-25696 | High | 7.5 | 2020-11-23 | A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5… |
CVE-2026-46608 | High | 7.4 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin… |
CVE-2026-50189 | High | 7.2 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith's bundled supervisord exposes an XML-RPC interface on port… |
CVE-2026-42043 | High | 7.2 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request… |
CVE-2024-1654 | High | 7.2 | 2024-03-14 | This vulnerability potentially allows unauthorized write operations which may lead to remote code execution. An attacker must already have authenticated admin… |
CVE-2025-24349 | High | 7.1 | 2025-04-30 | A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to delete t… |
CVE-2026-21915 | Medium | 6.7 | 2026-04-09 | A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, hig… |
CVE-2022-34450 | Medium | 6.7 | 2023-02-11 | PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability. An authenticated admin user could potentially exploit this issue… |
CVE-2023-4399 | Medium | 6.6 | 2023-10-17 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure G… |
CVE-2026-43574 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.12 contains an improper authorization vulnerability in helper-backed channels where empty resolved approver lists are interpreted as exp… |
CVE-2026-40899 | Medium | 6.5 | 2026-04-16 | DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the… |
CVE-2026-35649 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.22 contains a settings reconciliation vulnerability that allows attackers to bypass intended deny-all revocations by exploiting empty al… |