Weaknesses of type CWE-829

317 results

Inclusão de funcionalidade de esfera de controle não confiável

Ocorre quando o software importa, carrega ou executa código, bibliotecas ou componentes originários de uma fonte não confiável ou não verificada. O atacante consegue injetar funcionalidade maliciosa que rodará com os mesmos privilégios da aplicação, comprometendo a integridade e segurança do sistema.

Example

Uma aplicação web baixa dinamicamente um plugin ou módulo de um servidor externo sem validar assinatura criptográfica ou integridade. Um atacante intercepta ou compromete o servidor de origem e substitui o arquivo legítimo por uma versão maliciosa; a aplicação carrega e executa o código comprometido automaticamente.

How to mitigate

Valide sempre a origem, autenticidade e integridade de componentes antes de carregá-los: use assinatura digital criptográfica, checksums verificados, HTTPS com pinning de certificado e, quando possível, evite carregamento dinâmico. Mantenha inventário atualizado de dependências e aplique patches regularmente.

CVE-2026-92705HIGHAegisub executes arbitrary code through automatically loaded Automation scriptsEPSS 0.1%CVE-2026-123833LOWIn JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projectsEPSS 0.1%CVE-2026-55251MEDIUMNetBox Device Type Library: Arbitrary Code Execution on CI Runner Through Malicious requirements.txt, .pre-commit-hooks-config.yaml, and .gitmodules FilesEPSS 0.1%CVE-2026-41396HIGHOpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust RootEPSS 0.1%CVE-2022-49042HIGHAn inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.EPSS 0.1%CVE-2025-39666CRITICALomd: Local privilege escalation when executing omd commands as rootEPSS 0.1%CVE-2022-49036HIGHAn inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business ReEPSS 0.1%CVE-2026-41355MEDIUMOpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File ConversionEPSS 0.1%CVE-2026-105745MEDIUMDocling: Plugin entry points are imported before the allow_external_plugins checkEPSS 0.1%CVE-2025-67900HIGHNXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.EPSS 0.1%CVE-2026-113461MEDIUMmk-oracle: Local privilege escalation via insecure Oracle Home library loadingEPSS 0.1%CVE-2026-123313LOWIn JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settingsEPSS 0.1%CVE-2026-64894HIGHInclusion of functionality from untrusted control sphere vulnerability in Johnson Controls EasyIO Neo IOManager and Tools Installer allows MEPSS 0.1%CVE-2026-123322MEDIUMIn JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loaderEPSS 0.1%CVE-2026-11269HIGHInappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to eEPSS 0.1%CVE-2026-104809HIGHMitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code ExecutionEPSS 0.1%CVE-2026-105331MEDIUMmk-oracle: Local privilege escalation via malicious Oracle Instant ClientEPSS 0.1%