CWE-501.

Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

• Red Hat OpenShift Container Platform 4.16
• Red Hat OpenShift Container Platform 5
• CWE-501

Information disclosure in Eclipse Foundation Eclipse ThreadX

• Eclipse Foundation Eclipse ThreadX
• Information disclosure
• Memory corruption

Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

• kimdre doco-cd
• Weak cryptography or TLS
• CWE-501

Creation of a new configuration by posting a malicious ID to MQTT

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• CWE-501

vLLM: OpenAI auth bypass

• HTTP request smuggling
• CWE-501

>=0.3.0, <0.22.0 · fixed in 0.22.0

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

• CWE-501
• CWE-693

<3.4.7 · fixed in 3.4.7

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

• Cross-site scripting (XSS)
• CWE-501

<3.4.6 · fixed in 3.4.6

Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-501

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

• Command injection
• CWE-183

>=0.31.0, <0.83.0 · fixed in 0.83.0

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

• CWE-345
• CWE-501

<=1.7.34 · no fixed version yet

OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

• CWE-501

<2026.4.8 · fixed in 2026.4.8

OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

• CWE-501

<2026.4.8 · fixed in 2026.4.8

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

• Information disclosure
• CWE-501

>=39.0.0-alpha.1, <39.8.0 || >=40.0.0-alpha.1, <40.7.0 || >=41.0.0-alpha.1, <41.0.0-beta.8 · fixed in 39.8.0, 40.7.0, 41.0.0-beta.8

NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled.

• NVIDIA Jetson Xavier Series, Jetson Orin Series and Jetson Thor
• CWE-501

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

• CWE-501
• CWE-693

>=0.10.1, <0.18.0 · fixed in 0.18.0

Sandbox escape due to incorrect boundary conditions in the Telemetry component

• Mozilla Firefox
• Mozilla Thunderbird
• Memory corruption
• CWE-501

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

• Information disclosure
• CWE-501

<2.1.2 · fixed in 2.1.2

Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

• CWE-501

<1.1.0 · fixed in 1.1.0

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

• Code injection
• CWE-501

<0.6.35 · fixed in 0.6.35

Server-side request forgery in Oracle Corporation Oracle Configurator

• Oracle Corporation Oracle Configurator
• Path traversal
• Other injection

Visual Studio Code Python Extension Remote Code Execution Vulnerability

• Microsoft Python extension for Visual Studio Code
• CWE-501

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

• CWE-501

<2.12.1 · fixed in 2.12.1

Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-501

Visual Studio Code Python Extension Remote Code Execution Vulnerability

• Microsoft Python extension for Visual Studio Code
• CWE-501

DHCP routing options can manipulate interface-based VPN traffic

• IETF DHCP
• Authentication bypass
• CWE-501

A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot functionality and load a software image that…

• Cisco IOS XE Software
• Cisco Aironet Access Point Software
• CWE-501

kubevirt-csi: PersistentVolume allows access to HCP's root node

• CWE-501

<0.0.0-202403081943-cc28dcbb0afc14 · fixed in 0.0.0-202403081943-cc28dcbb0afc14

Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox

• CWE-501

<1.8.0 · fixed in 1.8.0

Improper handling of browser-side provided input in richdocuments path handling

• online
• Path traversal
• CWE-501

Docker Desktop 4.11.x allows --no-windows-containers flag bypass

• Docker Inc. Docker Desktop
• CWE-501

Improper trust boundary implementation for SMB in Zoom Clients

• Zoom Video Communications Inc Zoom (for Android, iOS, Linux, macOS, and Windows)
• Zoom Video Communications Inc Zoom Rooms (for Android, iOS, Linux, macOS, and Windows)
• CWE-501

Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers

• Docker Inc. Docker Desktop
• CWE-424
• CWE-501

Cisco Adaptive Security Appliance (ASA) Software: A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series…

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense Software
• CWE-501

Incorrect signature verification on Google play-services-basement in Google Play SDK

• Google LLC Google Play Services SDK
• CWE-501

Class Loading Vulnerability in Artemis

• CWE-501
• CWE-653

<1.8.0 · fixed in 1.8.0

Context isolation bypass via contextBridge in Electron

• CWE-501

<7.2.4 || >=8.0.0, <8.2.4 · fixed in 7.2.4, 8.2.4

Context isolation bypass via leaked cross-context objects in Electron

• CWE-501

<7.2.4 || >=8.0.0, <8.2.4 · fixed in 7.2.4, 8.2.4

Context isolation bypass via Promise in Electron

• CWE-501

<6.1.11 || >=7.0.0, <7.2.4 || >=8.0.0, <8.2.4 · fixed in 6.1.11, 7.2.4, 8.2.4

Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes

• Juniper Networks Junos OS
• CWE-501