Weaknesses of type CWE-829

317 results

Inclusão de funcionalidade de esfera de controle não confiável

Ocorre quando o software importa, carrega ou executa código, bibliotecas ou componentes originários de uma fonte não confiável ou não verificada. O atacante consegue injetar funcionalidade maliciosa que rodará com os mesmos privilégios da aplicação, comprometendo a integridade e segurança do sistema.

Example

Uma aplicação web baixa dinamicamente um plugin ou módulo de um servidor externo sem validar assinatura criptográfica ou integridade. Um atacante intercepta ou compromete o servidor de origem e substitui o arquivo legítimo por uma versão maliciosa; a aplicação carrega e executa o código comprometido automaticamente.

How to mitigate

Valide sempre a origem, autenticidade e integridade de componentes antes de carregá-los: use assinatura digital criptográfica, checksums verificados, HTTPS com pinning de certificado e, quando possível, evite carregamento dinâmico. Mantenha inventário atualizado de dependências e aplique patches regularmente.

CVE-2026-86504HIGHIn JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code executEPSS 0.2%CVE-2026-0303LOWCheckov by Prisma Cloud: Code Execution via Auto-Loaded Configuration FileEPSS 0.2%CVE-2026-1342HIGHSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.2%CVE-2026-40959CRITICALLuanti 5 before 5.15.2, when LuaJIT is used, allows a Lua sandbox escape via a crafted mod.EPSS 0.2%CVE-2026-55487HIGHpnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycleEPSS 0.2%CVE-2026-44358HIGHEspressif Shared GitHub DangerJS: Untrusted Search Path in DangerJS Action EntrypointEPSS 0.2%CVE-2026-6482HIGHLocal Privilege Escalation via OpenSSL configuration file in Insight AgentEPSS 0.2%CVE-2026-89332MEDIUMKiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationEPSS 0.2%CVE-2025-49809HIGHmtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: EPSS 0.2%CVE-2026-58569HIGHDell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited priviEPSS 0.2%CVE-2026-62222HIGHOpenClaw < 2026.5.22 Untrusted Plugin Loading via Setup-modeEPSS 0.2%CVE-2026-22816HIGHGradle fails to disable repositories which can expose builds to malicious artifactsEPSS 0.2%CVE-2026-123838HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form fileEPSS 0.2%CVE-2026-123853HIGHIn JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the buildEPSS 0.2%CVE-2026-42089HIGHyeoman-environment Vulnerable to Arbitrary Package Installation without User ConfirmationEPSS 0.2%CVE-2026-8426HIGHConcrete CMS 9.5.0 and below is vulnerable to CSRF on prepare_remote_upgrade() leading to one-request RCE via package overwriteEPSS 0.2%CVE-2026-7373HIGHMetasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File LoadingEPSS 0.2%CVE-2026-123854MEDIUMIn JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget moduleEPSS 0.2%CVE-2026-17647HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.2%CVE-2026-43940HIGHelecterm: Path traversal in electerm runWidget leads to arbitrary code executionEPSS 0.2%