Skip to content
OpenAdvisories

Weakness (CWE)

CWE-610: Externally Controlled Reference to a Resource in Another Sphere

Class Draft Mapping discouraged

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Source: MITRE CWE-610

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2026-15583 Public exploit

    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

    A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrar…

    Grafana Grafana MCP Server Web / CMS
  • High 8.2
    CVE-2024-47773 Public exploit

    Anonymous cache poisoning via XHR requests in Discourse

    Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patc…

    Discourse Discourse
  • High 8.8
    CVE-2024-24760 Public exploit

    Mailcow Docker Container Exposure to Local Network

    mailcow is a dockerized email package, with multiple containers linked in one bridged network. A security vulnerability has been identified in mailcow affecting versions < 2024-01c. This vulnerability potentially allows attackers on the same subnet to connect…

    mailcow mailcow-dockerized
  • High 7.8
    CVE-2023-21097 Public exploit

    In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. This co…

    Android