CWE-829: CWE-829
Yearly Trend
Top Affected Vendors
All CWE-829 CVEs (57)
This CVE describes a critical GitHub Actions vulnerability in Eclipse Theia's website repository where the pull_request_target trigger allowed untrust...
Jan 30, 2026This is a critical deserialization vulnerability in Fastjson that allows remote code execution via JNDI injection. Attackers can exploit it by sending...
Jan 9, 2026A sandbox escape vulnerability in Google Cloud Application Integration's JavaScript Task feature allows attackers to execute arbitrary unsandboxed cod...
Feb 6, 2025This vulnerability allows attackers with program modification access to alter user program code on Rockwell Automation ControlLogix, CompactLogix, and...
Apr 11, 2022This vulnerability allows unauthenticated remote attackers to read and write files on IBM Cognos Analytics systems by exploiting the DQM API. It affec...
Jun 1, 2021This vulnerability in OpenLIT's GitHub Actions workflows allows attackers to execute arbitrary code with repository write privileges and access sensit...
Feb 26, 2026This vulnerability allows remote attackers to execute arbitrary code as root on Langflow installations without authentication. The flaw exists in how ...
Jan 23, 2026Apache HTTP Server 2.4.59 and earlier contain a vulnerability where malicious response headers from backend applications can lead to information discl...
Jul 1, 2024This vulnerability in Dropbox Folder Share for WordPress allows unauthenticated attackers to include and execute arbitrary PHP files on the server via...
Oct 20, 2023This vulnerability allows attackers to execute arbitrary PHP code with root privileges on Extreme Networks wireless networking devices. Attackers can ...
Nov 14, 2021This vulnerability allows remote attackers to execute arbitrary PHP code through a local file inclusion flaw in Monstra CMS's captcha function. Attack...
Jun 17, 2021This vulnerability in Sudo allows local users to escalate privileges to root by exploiting the --chroot option to load a malicious /etc/nsswitch.conf ...
Jun 30, 2025Nextcloud servers with image previews enabled are vulnerable to server-side request forgery (SSRF), file disclosure, or potential remote code executio...
Sep 7, 2021This CVE describes a GitHub Actions vulnerability in Folo where the pull_request_target workflow allows execution of untrusted code with full access t...
Jul 9, 2025This vulnerability allows remote code execution (RCE) in n8n workflow automation platform by exploiting Git pre-commit hooks. Attackers who can create...
Dec 9, 2025This vulnerability in Siemens Spectrum Power 4 allows attackers to execute arbitrary commands with administrative privileges through the network-acces...
Nov 11, 2025This vulnerability allows remote code execution when users run Cursor CLI inside a malicious repository. Attackers can exploit permissive configuratio...
Oct 3, 2025This vulnerability allows a malicious PostgreSQL superuser on the source server to inject arbitrary code into database dumps. When the dump is restore...
Aug 14, 2025A vulnerability in Cisco Webex App's URL parser allows unauthenticated remote attackers to trick users into downloading malicious files via crafted me...
Apr 16, 2025This vulnerability allows authenticated Checkmk users to directly interact with the underlying Apache installation through reverse proxy configuration...
Apr 20, 2023Honeywell Alerton Visual Logic controllers allow unauthenticated remote users to write and execute arbitrary code without verification. This enables a...
Jul 15, 2022This vulnerability allows a local untrusted app with no special permissions to execute arbitrary code within the Magisk app and escalate privileges to...
Nov 4, 2024CVE-2022-41216 is a Local File Inclusion (LFI) vulnerability in Cloudflow that allows attackers to access sensitive files on the system, potentially e...
Feb 22, 2023NXLog Agent versions before 6.11 can be forced to load an attacker-controlled OpenSSL configuration file via the OPENSSL_CONF environment variable. Th...
Dec 14, 2025This vulnerability allows local file inclusion in ZTE routers' HTTPD binary, enabling attackers who can write malicious files to the /var/lua_session ...
Sep 16, 2024An unauthenticated remote command execution vulnerability in TP-Link wireless access points allows attackers to execute arbitrary commands by sending ...
Apr 9, 2024PHPMailer versions 6.4.1 and earlier contain a function name collision vulnerability in the email address validator. If a malicious function named 'ph...
Jun 17, 2021ADB Explorer versions 0.9.26020 and below fail to validate the ADB binary path before execution, allowing arbitrary code execution with current user p...
Feb 20, 2026This CVE describes a local privilege escalation vulnerability in Akamai's Guardicore Platform Agent for Windows. An unprivileged local user can create...
Dec 3, 2025CVE-2025-49809 is a privilege escalation vulnerability in mtr (network diagnostic tool) where the MTR_PACKET environment variable can be abused to exe...
Jul 4, 2025This vulnerability allows local users to execute arbitrary code on systems running vulnerable versions of Synology Drive Client. Attackers with local ...
Sep 26, 2024This CVE involves a documentation error in Apache Airflow HDFS Provider versions before 4.1.1, which incorrectly directed users to install an unclaime...
Sep 14, 2023This vulnerability allows unauthenticated attackers to execute arbitrary malicious code by tricking users into loading specially crafted monitoring sc...
Jul 20, 2022CVE-2022-25485 is a local file inclusion vulnerability in CuppaCMS v1.0 that allows attackers to read arbitrary files on the server via the url parame...
Mar 15, 2022This vulnerability allows attackers to include local PHP files in Hospital Patient Record Management System v1.0, potentially leading to arbitrary cod...
Feb 24, 2022This vulnerability allows attackers to corrupt SMRAM memory through insufficient validation of buffer pointers in SMM SWSMI handlers, potentially lead...
Oct 1, 2021This vulnerability allows any user on a system with NVIDIA DCGM to inject malicious shared libraries into the DCGM server process, which typically run...
Aug 13, 2021CVE-2021-34692 is a privilege escalation vulnerability in iDrive RemotePC for Windows. Local low-privileged users can execute arbitrary code with SYST...
Jul 15, 2021This vulnerability allows authenticated attackers in UmbracoForms to execute arbitrary code by supplying a malicious WSDL URL as a data source. It aff...
Jan 16, 2026This CVE describes a Local File Inclusion vulnerability in Zimbra Collaboration's Webmail Classic UI. Authenticated attackers can access sensitive fil...
Dec 19, 2024An unauthenticated attacker can send a specific IEEE 802.15.4 'co-ordinator realignment' packet to Zigbee nodes, forcing them to change their network ...
Jun 27, 2024CVE-2023-4591 is a local file inclusion vulnerability in WPN-XM Serverstack version 0.8.6 that allows unauthenticated attackers to load arbitrary PHP ...
Nov 3, 2023CVE-2022-34121 is a local file inclusion vulnerability in Cuppa CMS v1.0 that allows attackers to read arbitrary files on the server via the /template...
Jul 27, 2022CVE-2021-41569 is a local file inclusion vulnerability in SAS/Intrnet 9.4 that allows authenticated users to escape macro variable constraints and exe...
Nov 19, 2021CVE-2024-28184 is a vulnerability in WeasyPrint that allows attackers to bypass URL fetching restrictions and attach arbitrary file or URL content to ...
Mar 9, 2024The NVIDIA NeMo framework contains a vulnerability where attackers can exploit a predefined variable to include functionality from untrusted sources, ...
Nov 25, 2025This vulnerability affects TBox RTUs running OpenVPN with root privileges. An attacker can set up a local OpenVPN server and push malicious scripts to...
Jul 3, 2023XunRuiCMS versions 4.3.3 to 4.5.1 contain a vulnerability in the cron.php add function that allows authenticated attackers to write arbitrary PHP file...
Mar 23, 2023This vulnerability allows attackers to execute arbitrary commands on Windows systems by crafting malicious shared Anki decks that trigger command exec...
Oct 7, 2025This vulnerability in JetBrains IntelliJ IDEA allows unexpected plugin startup due to automatic Language Server Protocol (LSP) server activation, pote...
Aug 20, 2025About CWE-829 (CWE-829)
Our database tracks 57 CVEs classified as CWE-829, with 14 rated critical and 34 rated high severity. The average CVSS score for CWE-829 vulnerabilities is 7.9.
External reference: View CWE-829 on MITRE CWE →
Monitor CWE-829 Vulnerabilities
Get alerted when new CWE-829 CVEs affect your infrastructure.
Start Monitoring Free