CWE-470 · Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
70 CVEs classified under CWE-470 (Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46562 | Critical | 9.8 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main… |
CVE-2026-40008 | Critical | 9.8 | 2026-07-10 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Ja… |
CVE-2026-42027 | Critical | 9.8 | 2026-05-04 | Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Des… |
CVE-2025-34393 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL… |
CVE-2025-53693 | Critical | 9.8 | 2025-09-03 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experie… |
CVE-2023-6943 | Critical | 9.8 | 2024-01-30 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5… |
CVE-2021-31522 | Critical | 9.8 | 2022-01-06 | Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3… |
CVE-2021-21985 | Critical | 9.8 | 2021-05-26 | The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enab… |
CVE-2019-1003041 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2019-1003040 | Critical | 9.8 | 2019-03-28 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts. |
CVE-2018-1000613 | Critical | 9.8 | 2018-07-09 | Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controll… |
CVE-2025-63690 | Critical | 9.1 | 2025-11-07 | In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible… |
CVE-2024-4990 | Critical | 9.1 | 2025-03-20 | In yiisoft/yii2 version 2.0.48, the base Component class contains a vulnerability where the `__set()` magic method does not validate that the value passed is a… |
CVE-2024-8015 | Critical | 9.1 | 2024-10-09 | In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure… |
CVE-2023-32217 | Critical | 9.0 | 2023-06-05 | IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior t… |
CVE-2026-44795 | High | 8.8 | 2026-07-10 | Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses saf… |
CVE-2024-8014 | High | 8.8 | 2024-10-09 | In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolu… |
CVE-2024-6096 | High | 8.8 | 2024-07-24 | In Progress® Telerik® Reporting versions prior to 18.1.24.709, a code execution attack is possible through object injection via an insecure type resolution vul… |
CVE-2024-28121 | High | 8.8 | 2024-03-12 | stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time we… |
CVE-2023-33652 | High | 8.8 | 2023-06-06 | Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/I… |