Skip to content
OpenAdvisories

Weakness (CWE)

CWE-749: Exposed Dangerous Method or Function

Base Incomplete

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

More detail

Many different kinds of technologies effectively provide access to methods or functions, such as ActiveX controls, Java functions, IOCTLs, and so on.

The exposure can occur in a few different ways:

- The function/method was never intended to be exposed to outside actors.

- The function/method was only intended to be accessible to a limited set of actors, such as Internet-based access from a single web site.

How to prevent it (2 mitigations)

  1. Architecture and Design

    If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.

  2. Architecture and Design, Implementation

    Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:

    - accessible to all users

    - restricted to a small set of privileged users

    - prevented from being directly accessible at all

    Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.

Source: MITRE CWE-749

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-116779 Exploited Public exploit

    FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of …

    signalwire freeswitch
    KEV Nov 9, 2026
  • Critical 10.0
    CVE-2026-77521 Public exploit

    MaxKB: Prompt-injectable agent can lead to command execution

    MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on…

    1Panel-dev MaxKB
  • Critical 9.8
    CVE-2026-24118 Public exploit

    VM2 Sandbox Breakout Through __lookupGetter__

    vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue h…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-26190 Public exploit EPSS 39%

    Milvus Allows Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

    Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication…

    milvus-io milvus github.com/milvus-io/milvus Go
  • Critical 10.0
    CVE-2022-31491 Public exploit

    Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-232…

  • Critical 9.6
    CVE-2025-53964 Public exploit

    GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a c…

    goldendict Ubuntu