CWE-829.

Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access Container
• IBM Security Verify Access Container
• CWE-829

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

• CWE-829

<2026.4.2 · fixed in 2026.4.2

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

• CWE-829

<2026.3.28 · fixed in 2026.3.28

omd: Local privilege escalation when executing omd commands as root

• Checkmk
• CWE-426
• CWE-829

OpenClaw: Workspace `.env` can override the bundled plugin trust root

• CWE-15
• CWE-829

<2026.3.31 · fixed in 2026.3.31

OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

• CWE-15
• CWE-829

<2026.3.31 · fixed in 2026.3.31

FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

• freescout
• Open redirect
• CWE-20

Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

• CWE-829

<2026.3.12 · fixed in 2026.3.12

Elevation of Privileges in Symantec Data Loss Prevention Windows Endpoint

• Broadcom Data Loss Prevention
• CWE-829

Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE

• Wazuh Provisioning Scripts (Agent Build Environment)
• Weak cryptography or TLS
• CWE-829

HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability

• HCL Aftermarket DPC
• CWE-829

FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

• labring FastGPT
• CWE-494
• CWE-829

Arbitrary code execution via crafted project files in Kiro IDE

• AWS Kiro IDE
• CWE-829

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack

• CWE-345
• CWE-494

<1.21.0rc1 · fixed in 1.21.0rc1

DLL Injection Privilege Escalation

• thermalright TR-VISION HOME
• CWE-829

OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

• CWE-829

<2026.3.12 · fixed in 2026.3.12

An issue pertaining to CWE-829: Inclusion of Functionality from Untrusted Control Sphere was discovered in Miazzy oa-front-service master.

• CWE-829

WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability

• WP Royal Royal Elementor Addons
• CWE-829

OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

• CWE-184
• CWE-829

>=2026.2.22, <2026.2.23 · fixed in 2026.2.23

OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

• CWE-426
• CWE-428

<2026.2.24 · fixed in 2026.2.24

Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.

• Mattermost
• CWE-829

CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage

• Cross-site scripting (XSS)
• CWE-829

<1.15.3 · fixed in 1.15.3

GNU inetutils: telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by…

• GNU inetutils
• CWE-829

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking ou...

• CWE-829

>=1.36.2, <1.37.1 · fixed in 1.37.1

ADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE)

• Alex4SSB ADB-Explorer
• CWE-40
• CWE-829

ADB Explorer Vulnerable to RCE via Insufficient Input Validation

• Alex4SSB ADB-Explorer
• CWE-829

Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

• CWE-829

<0.0.5 · fixed in 0.0.5

OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access

• OpenS100
• CWE-749
• CWE-829

Roundcube Webmail: Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)…

• Roundcube Webmail
• CWE-829

vscode-spell-checker has a workspace-trust bypass Code Execution

• streetsidesoftware vscode-spell-checker
• Broken access control
• CWE-807

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code.

• Eclipse Foundation Eclipse Theia - Website
• CWE-829

Langflow affected by Remote Code Execution via validate_code() exec()

• CWE-829

<=1.7.3 · no fixed version yet

Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts

• gradle
• CWE-494
• CWE-829

Gradle fails to disable repositories which can expose builds to malicious artifacts

• gradle
• CWE-494
• CWE-829

UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation

• Code injection
• Insecure deserialization

<=8.13.16 · no fixed version yet

FASTJSON Includes Functionality from Untrusted Control Sphere

• CWE-829

<1.2.48 · fixed in 1.2.48

Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion

• Pro-Bravia Sony BRAVIA Digital Signage
• CWE-829

FIBARO System Home Center 5.021 Remote File Inclusion via Proxy API

• FIBAR GROUP S.A. Home Center 3
• FIBAR GROUP S.A. Home Center 2
• CWE-829

theshit vulnerable to unsafe loading of user-owned Python rules when running as root

• Privilege escalation
• Broken access control

>=0.0.0-0, <0.1.1 · fixed in 0.1.1

Mintlify Platform: The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to…

• Mintlify Platform
• CWE-829

JetBrains TeamCity: In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via…

• JetBrains TeamCity
• CWE-829

NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.

• NXLog Agent
• CWE-829

n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook

• CWE-829

>=0.123.1, <1.119.2 · fixed in 1.119.2

Akamai Guardicore Platform Agent: The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows…

• Akamai Guardicore Platform Agent
• CWE-829

FACTION Unauthenticated Custom Extension Upload leads to RCE

• faction
• Authentication bypass
• CWE-829

NVIDIA NeMo Framework: NVIDIA NeMo framework contains a vulnerability in a predefined variable…

• NVIDIA NeMo Framework
• CWE-829

A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2).

• Siemens Spectrum Power 4
• CWE-829

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

• Code injection
• CWE-501

<0.6.35 · fixed in 0.6.35

Scripts for the module Global_Shipping executable on BRAIN2 Server

• Bizerba BRAIN2
• CWE-829

n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook

• CWE-829

<1.113.0 · fixed in 1.113.0

Local File Inclusion in ArkSigner's AcBakImzala

• ArkSigner Software and Hardware Inc. AcBakImzala
• File inclusion
• CWE-829

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co.

• Truffle Security Co. TruffleHog
• CWE-829

HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.

• HCL MyXalytics
• CWE-829

Anki: Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute…

• Anki
• CWE-829

IBM Security Verify Access code execution

• IBM Security Verify Access Appliance
• IBM Security Verify Access Docker
• CWE-829

Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config

• cursor
• CWE-829

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

• Broken access control
• CWE-829

<1.0.39 · fixed in 1.0.39

DNN allows loading unused themes on anonymous clients through query parameters

• Information disclosure
• CWE-20

<10.1.0 · fixed in 10.1.0

Electron has ASAR Integrity Bypass via resource modification

• Code injection
• CWE-829

<35.7.5 || >=36.0.0-alpha.1, <36.8.1 || >=37.0.0-alpha.1, <37.3.1 || >=38.0.0-alpha.1, <38.0.0-beta.6 · fixed in 35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6

JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to…

• JetBrains IntelliJ IDEA
• CWE-829