CWE-706 · Use of Incorrectly-Resolved Name or Reference
116 CVEs classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65474 | Critical | 9.8 | 2025-12-11 | An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via re… |
CVE-2025-24813 | Critical | 9.8 | 2025-03-10 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files vi… |
CVE-2024-35198 | Critical | 9.8 | 2024-07-19 | TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowed_urls configuration can be by… |
CVE-2023-31814 | Critical | 9.8 | 2023-05-23 | D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php. |
CVE-2022-30258 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be… |
CVE-2022-30257 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be… |
CVE-2021-40539 | Critical | 9.8 | 2021-09-07 | Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution. |
CVE-2020-23448 | Critical | 9.8 | 2021-01-26 | newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java. The authentication logic of t… |
CVE-2020-15505 | Critical | 9.8 | 2020-07-07 | A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0… |
CVE-2020-12279 | Critical | 9.8 | 2020-04-27 | An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. Thi… |
CVE-2020-12278 | Critical | 9.8 | 2020-04-27 | An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Strea… |
CVE-2020-10574 | Critical | 9.8 | 2020-03-14 | An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "query_logger" Admin API request, because of… |
CVE-2019-8908 | Critical | 9.8 | 2019-02-18 | An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registratio… |
CVE-2019-8395 | Critical | 9.8 | 2019-02-17 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a requ… |
CVE-2019-7731 | Critical | 9.8 | 2019-02-11 | MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database, and executes the Backup Database function w… |
CVE-2026-35039 | Critical | 9.1 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly crea… |
CVE-2021-37315 | Critical | 9.1 | 2023-02-03 | Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbit… |
CVE-2021-37144 | Critical | 9.1 | 2021-07-30 | CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the… |
CVE-2026-62190 | High | 8.8 | 2026-07-13 | OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist acti… |
CVE-2026-35666 | High | 8.8 | 2026-04-10 | OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass… |