Weakness (CWE)
CWE-669: Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Source: MITRE CWE-669
95 results · Feed
-
Medium 4.7
Remote Code Execution in multiple BinSoft products
Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in…
-
Medium 6.5
KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of t…
-
High 7.8
crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…
KEV May 1, 2026 -
Medium 6.2
In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM …
-
Low 2.9
In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of arbitrary users when a "logger -p e…
-
Medium 6.4
In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel out…
-
Medium 5.3
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element …
-
Medium 5.3
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
-
Medium 5.3
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
-
Medium 5.3
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypas…
-
Medium 5.4
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
-
High 8.8
CODESYS Control Boot Application Replacement Enables Code Execution
A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
-
Medium 6.3
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
-
Low 3.4
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON…
-
High 8.2
OpenStack Nova calls qemu-img without format restrictions for resize
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img withou…
-
High 8.8
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.
-
Medium 4.3
Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that retur…
-
Critical 9.8
Apache Airflow Providers Edge3: Edge3 Worker RPC RCE on Airflow 2
Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released…
-
High 8.0
Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
-
Medium 4.0
XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
-
Medium 5.0
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the s…
-
Medium 4.3
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2…
-
Low 3.5
The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers w…
-
Low 3.7
PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing ipt…
-
Low 3.7
PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon netw…
-
Low 3.2
Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency acc…
-
Medium 5.7
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program t…
-
High 7.7
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though th…
-
High 8.5CVE-2025-34158 Public exploit
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between sphe…
-
Low 3.2
The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header …
-
Low 3.7CVE-2025-54352 Public exploit
WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RP…
-
Medium 4.0
qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL. This affects rsswidg…
-
High 8.6
SMA: Sunny Portal demo system privilege escalation
An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.
-
Low 2.1
@misskey-dev/summaly Redirect Filter Bypass
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` function causes the `allowRedirects` option to never be passed to any plugins, and as a result, isn't…
-
High 7.8
youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
#### Description This advisory follows the security advisory [GHSA-79w7-vh3h-8g4j published by the _yt-dlp/yt-dlp_ project](https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-79w7-vh3h-8g4j) to aid remediation of the issue in the _ytdl-org/youtube-dl_ …
-
Low 2.7
Incorrect resource transfer between spheres issue exists in RevoWorks SCVX and RevoWorks Browser. If exploited, malicio…
-
High 7.8
yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization
`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the extensions of downloaded files, which could lead to arbitrary filenames being created in the download folder (and path …
-
Medium 4.4
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with `ProxyManager`, the `Proxy-Authorization` header is only sent to the configured proxy, as expected. However, when sending HTTP requests *without* using urllib3'…
-
Medium 5.9
External DNS requests from 'internal' networks could lead to data exfiltration
Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and …
-
Medium 5.3
Local-only webhooks externally accessible via SniTun in Home Assistant Core
Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local n…