Weaknesses of type CWE-829

317 results

Inclusão de funcionalidade de esfera de controle não confiável

Ocorre quando o software importa, carrega ou executa código, bibliotecas ou componentes originários de uma fonte não confiável ou não verificada. O atacante consegue injetar funcionalidade maliciosa que rodará com os mesmos privilégios da aplicação, comprometendo a integridade e segurança do sistema.

Example

Uma aplicação web baixa dinamicamente um plugin ou módulo de um servidor externo sem validar assinatura criptográfica ou integridade. Um atacante intercepta ou compromete o servidor de origem e substitui o arquivo legítimo por uma versão maliciosa; a aplicação carrega e executa o código comprometido automaticamente.

How to mitigate

Valide sempre a origem, autenticidade e integridade de componentes antes de carregá-los: use assinatura digital criptográfica, checksums verificados, HTTPS com pinning de certificado e, quando possível, evite carregamento dinâmico. Mantenha inventário atualizado de dependências e aplique patches regularmente.

CVE-2025-36355HIGHIBM Security Verify Access code executionEPSS 0.2%CVE-2025-33205HIGHNVIDIA NeMo framework contains a vulnerability in a predefined variable, where an attacker could cause inclusion of functionality from an unEPSS 0.2%CVE-2026-54325MEDIUMPi loads project-local extensions without approvalEPSS 0.2%CVE-2026-65119HIGHNVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusiEPSS 0.2%CVE-2026-1628MEDIUMMattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.EPSS 0.2%CVE-2026-59172HIGHJoker linter executed project-local .jokerd/linter.* files during lintingEPSS 0.2%CVE-2026-86949HIGHThis issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be aEPSS 0.2%CVE-2026-49986HIGHCortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`EPSS 0.2%CVE-2026-16085MEDIUMSipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphereEPSS 0.2%CVE-2026-22865HIGHGradle's failure to disable repositories failing to answer can expose builds to malicious artifactsEPSS 0.2%CVE-2025-53841HIGHThe GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.EPSS 0.2%CVE-2026-24226MEDIUMNVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploEPSS 0.2%CVE-2026-73073HIGHVim: Arbitrary Ex Command Execution in C Omni-CompletionEPSS 0.2%CVE-2024-45482HIGHPrivilege escalation in B&R APROLEPSS 0.1%CVE-2026-25931HIGHvscode-spell-checker has a workspace-trust bypass Code ExecutionEPSS 0.1%CVE-2026-45184MEDIUMKdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.EPSS 0.1%CVE-2026-123858MEDIUMIn JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsEPSS 0.1%CVE-2026-44312MEDIUMcss_parser allows to MITM included https css urlsEPSS 0.1%CVE-2026-123843LOWIn JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configurationEPSS 0.1%CVE-2026-123849HIGHIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File WatchersEPSS 0.1%