CWE-403 · Exposure of File Descriptor to Unintended Control Sphere (File Descriptor Leak)

8 CVEs classified under CWE-403 (Exposure of File Descriptor to Unintended Control Sphere (File Descriptor Leak)). Browse by severity and year.

Top CVEs for CWE-403
CVESeverityScorePublishedSummary
CVE-2026-40042Critical9.82026-04-13Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML par…
CVE-2025-15114Critical9.82025-12-30Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML fil…
CVE-2026-12296Critical9.62026-06-16Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird…
CVE-2026-16526High8.82026-07-30A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privilege…
CVE-2024-58280High8.82025-12-10CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. A…
CVE-2024-21626High8.62024-01-31runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descrip…
CVE-2025-3032High7.42025-04-01Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox…
CVE-2026-33263Medium4.32026-08-28When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If r…
All CVEs classified under CWE-403 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-33263Medium4.32026-08-28When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If r…
CVE-2026-16526High8.82026-07-30A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privilege…
CVE-2026-12296Critical9.62026-06-16Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird…
CVE-2026-40042Critical9.82026-04-13Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML par…
CVE-2025-15114Critical9.82025-12-30Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML fil…
CVE-2024-58280High8.82025-12-10CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. A…
CVE-2025-3032High7.42025-04-01Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox…
CVE-2024-21626High8.62024-01-31runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descrip…