CWE-913 · Improper Control of Dynamically-Managed Code Resources

93 CVEs classified under CWE-913 (Improper Control of Dynamically-Managed Code Resources). Browse by severity and year.

Top CVEs for CWE-913
CVESeverityScorePublishedSummary
CVE-2026-47208Critical10.02026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code w…
CVE-2026-47137Critical10.02026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 26…
CVE-2026-47131Critical10.02026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.cal…
CVE-2026-23830Critical10.02026-01-28SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `Sandbo…
CVE-2023-29017Critical10.02023-04-06vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects pass…
CVE-2022-36067Critical10.02022-09-06vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandb…
CVE-2026-34156Critical9.92026-03-31NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow S…
CVE-2026-25049Critical9.92026-02-04n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows c…
CVE-2025-68613Critical9.92025-12-19n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Ex…
CVE-2026-53753Critical9.82026-06-23Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST…
CVE-2026-47210Critical9.82026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host proces…
CVE-2026-22709Critical9.82026-01-26vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be b…
CVE-2025-25270Critical9.82025-07-08An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
CVE-2024-8953Critical9.82025-03-20In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to…
CVE-2024-5452Critical9.82024-06-06A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user in…
CVE-2023-43177Critical9.82023-11-18CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
CVE-2023-4041Critical9.82023-08-23Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon…
CVE-2023-29199Critical9.82023-04-14There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleEx…
CVE-2022-44000Critical9.82022-11-16An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system comma…
CVE-2021-22387Critical9.82021-08-02There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow…
All CVEs classified under CWE-913 — newest first (page 1 of 1)
CVESeverityScorePublishedSummary
CVE-2026-73226High8.82026-08-11electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client…
CVE-2026-53753Critical9.82026-06-23Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST…
CVE-2026-48775Medium6.82026-06-16LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and p…
CVE-2026-47210Critical9.82026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host proces…
CVE-2026-47208Critical10.02026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code w…
CVE-2026-47137Critical10.02026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 26…
CVE-2026-47131Critical10.02026-06-12vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.cal…
CVE-2026-487002026-05-22An issue was discovered in all versions of PCManFM-Qt starting from 1.1.0. When a regular file's path is passed as a URI in an org.freedesktop.FileManager1.Sho…
CVE-2026-44336Critical9.62026-05-08PraisonAI is a multi-agent teams system. Prior to version 4.6.34, PraisonAI's MCP (Model Context Protocol) server (praisonai mcp serve) registers four file-han…
CVE-2026-7381Critical9.12026-04-29Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation se…
CVE-2026-5251Medium6.32026-04-01A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoi…
CVE-2026-5248Medium6.32026-04-01A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the compo…
CVE-2026-34156Critical9.92026-03-31NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow S…
CVE-2026-33286Critical9.12026-03-24Graphiti is a framework that sits on top of models and exposes them via a JSON:API-compliant interface. Versions prior to 1.10.2 have an arbitrary method execu…
CVE-2025-69219High8.82026-03-09A user with access to the DB could craft a database entry that would result in executing code on Triggerer - which gives anyone who have access to DB the same…
CVE-2026-25049Critical9.92026-02-04n8n is an open source workflow automation platform. Prior to versions 1.123.17 and 2.5.2, an authenticated user with permission to create or modify workflows c…
CVE-2026-17702026-02-02Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2026-23830Critical10.02026-01-28SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `Sandbo…
CVE-2026-22709Critical9.82026-01-26vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be b…
CVE-2025-66398Critical9.62026-01-01Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal sta…
CVE-2025-68613Critical9.92025-12-19n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Ex…
CVE-2025-14695Medium6.32025-12-15A vulnerability was determined in SamuNatsu HaloBot up to 026b01d4a896d93eaaf9d5163a287dc9f267515b. Affected is the function html_renderer of the file plugins/…
CVE-2025-13659High8.82025-12-09Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to wr…
CVE-2025-134262025-12-05A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remo…
CVE-2025-14085Medium6.32025-12-05A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the…
CVE-2025-14051Medium6.32025-12-04A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addr…
CVE-2024-5401Medium4.32025-12-04Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager (DSM) before 7.1.1-42962-8 and 7.2.1-6…
CVE-2025-54065High7.92025-12-03GZDoom is a feature centric port for all Doom engine games. GZDoom is an open source Doom engine. In versions 4.14.2 and earlier, ZScript actor state handling…
CVE-2025-26405Medium5.92025-11-11Improper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileg…
CVE-2025-61780Medium5.82025-10-10Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sen…
CVE-2025-9905High7.32025-09-19The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One can create a specially crafted .h5/.hdf5…
CVE-2025-25270Critical9.82025-07-08An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.
CVE-2025-6705Medium5.32025-06-27A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’…
CVE-2025-6384Critical9.12025-06-19Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via…
CVE-2025-6107Low3.12025-06-16A vulnerability was found in comfyanonymous comfyui 0.3.40. It has been classified as problematic. Affected is the function set_attr of the file /comfy/utils.p…
CVE-2025-46675Low3.52025-04-27In NASA CryptoLib before 1.3.2, the key state is not checked before use, potentially leading to spacecraft hijacking.
CVE-2025-46673Medium4.92025-04-27NASA CryptoLib before 1.3.2 does not check whether the SA is in an operational state before use, possibly leading to a bypass of the Space Data Link Security p…
CVE-2025-31674High7.52025-03-31Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects D…
CVE-2024-8953Critical9.82025-03-20In composiohq/composio version 0.4.3, the mathematical_calculator endpoint uses the unsafe eval() function to perform mathematical operations. This can lead to…
CVE-2022-31764High8.52025-02-06The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL of H2 database. This issue affects Apac…
CVE-2024-7297High8.82024-07-30Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privilege…
CVE-2024-5452Critical9.82024-06-06A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user in…
CVE-2024-2537Medium4.42024-03-15Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion.
CVE-2024-27135High8.52024-03-12Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, out…
CVE-2023-50386High8.82024-02-09Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphe…
CVE-2023-6184Medium5.02024-01-18Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting
CVE-2023-31032High7.52024-01-12NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability…
CVE-2023-43177Critical9.82023-11-18CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
CVE-2023-5763Medium6.82023-11-03In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the…
CVE-2022-4318High7.82023-09-25A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
CVE-2023-39983Medium5.32023-09-02A vulnerability that poses a potential risk of polluting the MXsecurity sqlite database and the nsm-web UI has been identified in MXsecurity versions prior to…
CVE-2023-4041Critical9.82023-08-23Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon…
CVE-2023-37271High8.42023-07-11RestrictedPython is a tool that helps to define a subset of the Python language which allows users to provide a program input into a trusted environment. Restr…
CVE-2023-35930Low3.72023-06-26SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a neg…
CVE-2023-33175Critical9.12023-05-30ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables…
CVE-2023-29199Critical9.82023-04-14There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleEx…
CVE-2023-29017Critical10.02023-04-06vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects pass…
CVE-2022-43441High8.12023-03-16A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can l…
CVE-2023-25560High8.22023-02-11DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or…
CVE-2022-44000Critical9.82022-11-16An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system comma…
CVE-2022-3225High8.82022-09-16Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20.
CVE-2022-40635Medium6.42022-09-13Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2022-40634Medium6.42022-09-13Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2022-36067Critical10.02022-09-06vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandb…
CVE-2022-39051Medium6.82022-09-05Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverified 3th party package
CVE-2022-27889Medium5.32022-06-14The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization operations. A maliciou…
CVE-2021-23267High7.62022-05-16Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2022-25355Medium5.32022-02-24EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the…
CVE-2022-25265High7.82022-02-16In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Li…
CVE-2021-42809Medium6.52021-12-20Improper Access Control of Dynamically-Managed Code Resources (DLL) in Thales Sentinel Protection Installer could allow the execution of arbitrary code.
CVE-2021-23262Medium4.22021-12-02Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.
CVE-2021-23259Medium4.22021-12-02Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib to render a webpage. The groovy script…
CVE-2021-23258Medium4.22021-12-02Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security re…
CVE-2021-32813Medium4.82021-08-03Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connect…
CVE-2021-22387Critical9.82021-08-02There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow…
CVE-2021-32563Critical9.82021-05-11An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a differe…
CVE-2021-21413High8.02021-03-30isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. Versions of isolated-vm before v4.0.0 have API pitfalls which may make it…
CVE-2020-15568Critical9.82021-01-30TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in i…
CVE-2021-26276Medium5.32021-01-27scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendo…
CVE-2020-3419Medium6.52020-11-18A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appeari…
CVE-2020-25803Medium4.22020-10-06Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2020-25802Medium4.22020-10-06Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands vi…
CVE-2020-15372Medium5.52020-09-25A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0_CBN3, v8.2.1e, v8.1.2k, v9.0.0, c…
CVE-2020-4100Medium4.42020-07-15"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be…
CVE-2019-15006Medium6.52019-12-19There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was u…
CVE-2019-1617High7.42019-03-11A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenti…
CVE-2019-1595High7.42019-03-06A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to…
CVE-2018-19836Medium6.12018-12-03In Metinfo 6.1.3, include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header), and common.inc.php allows registering var…
CVE-2017-3202Critical9.82018-06-11The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their…
CVE-2017-3200High8.12018-06-11The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less…
CVE-2014-9852Critical9.82017-03-17distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vect…
CVE-2012-2055High7.52012-04-05GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set…
CVE-2006-7079Critical9.82007-03-02Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduc…