Skip to content
OpenAdvisories

Weakness (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

Class Draft Mapping discouraged

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

More detail

Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.

A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.

In either case, the end result is that a resource has been exposed to the wrong party.

Source: MITRE CWE-668

All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 7.3
    CVE-2026-102262 Public exploit

    Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

    Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a job file alongside malicious modules / DLL that sets the process working directory to the job file's folder when a victim…

    Newell Brands DYMO ID
  • Critical 9.8
    CVE-2026-14960 Public exploit

    CVE-2026-14960

    Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbit…

    Pegatron Tdelo64.sys
  • High 7.3
    CVE-2026-44338 Public exploit EPSS 33%

    PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

    PraisonAI is a multi-agent teams system. From version 2.5.6 to before version 4.6.34, PraisonAI ships a legacy Flask API server with authentication disabled by default. When that server is used, any caller that can reach it can access /agents and trigger the …

    MervinPraison PraisonAI praisonai PyPI
  • Critical 9.1
    CVE-2026-25643 Public exploit

    Frigate Affected by Authenticated Remote Command Execution (RCE) and Container Escape

    Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.4, a critical Remote Command Execution (RCE) vulnerability has been identified in the Frigate integration with go2rtc. The application does not saniti…

    blakeblackshear frigate
  • High 8.8
    CVE-2026-25253 Public exploit EPSS 32%

    OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl

    OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.

    OpenClaw OpenClaw clawdbot npm
  • Critical 9.3
    CVE-2025-9074 Public exploit

    Docker Desktop allows unauthenticated access to Docker Engine API from containers

    A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. This vulnerability occurs with or without Enhanced Container Isolati…

    Docker Docker Desktop
  • High 8.8
    CVE-2025-34119 Public exploit

    EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43

    A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If t…

    Tinasoft EasyCafe Server
  • Medium 5.3
    CVE-2024-40725 Public exploit

    Apache HTTP Server: source code disclosure with handlers configured via AddType

    A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result …

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • High 8.6
    CVE-2024-21626 Public exploit EPSS 19%

    runc container breakout through process.cwd trickery and leaked fds

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…

    opencontainers runc github.com/opencontainers/runc runc Debian Ubuntu Alpine Go
  • High 7.5
    CVE-2023-27564 Public exploit

    n8n Information Disclosure vulnerability

    The n8n package 0.218.0 for Node.js allows Information Disclosure.

    n8n npm
  • Medium 6.5
    CVE-2022-38599 Public exploit

    Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /use…

  • High 8.1
    CVE-2022-38813 Public exploit

    PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows att…

  • High 7.5
    CVE-2022-24897 Public exploit

    Arbitrary filesystem write access from Velocity

    APIs to evaluate content with Velocity is a package for APIs to evaluate content with Velocity. Starting with version 2.3 and prior to 12.6.7, 12.10.3, and 13.0, the velocity scripts are not properly sandboxed against using the Java File API to perform read o…

    xwiki xwiki-commons org.xwiki.commons:xwiki-commons-velocity Maven
  • High 7.8
    CVE-2022-27772 Public exploit

    Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot

    spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only…

    org.springframework.boot:spring-boot Maven
  • Critical 9.8
    CVE-2022-25236 Public exploit EPSS 35%

    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

    thunderbird firefox insighttoolkit4 expat Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2021-36749 Public exploit EPSS 81%

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)

    In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t…

    Apache Software Foundation Apache Druid org.apache.druid:druid-core Maven
  • Medium 5.6
    CVE-2020-15215 Public exploit

    Context isolation bypass in Electron

    Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affe…

    electron electron electron npm
  • High 7.5
    CVE-2019-20149 Public exploit

    Validation Bypass in kind-of

    ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate…

    kind-of node-kind-of node-kind-of Debian Ubuntu npm