Skip to content
OpenAdvisories

Weakness (CWE)

CWE-403: Exposure of File Descriptor to Unintended Control Sphere

Base Draft

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Source: MITRE CWE-403

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.6
    CVE-2026-12296

    Sandbox escape in the Security: Process Sandboxing component

    Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Critical 9.8
    CVE-2026-40042

    Pachno 1.0.6 Wiki TextParser XML External Entity Injection

    Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting unsafe XML parsing in the TextParser helper. Attackers can inject malicious XML entities through wiki table syntax…

    Pachno Pachno
  • Critical 9.8
    CVE-2025-15114

    Ksenia Security lares Home Automation 1.6 PIN Exposure Vulnerability

    Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authentication. Attackers can retrieve the PIN from the server response to bypass security m…

    Ksenia Security S.p.A. lares