CWE-470 · weakness in Command and Code Injection
Use of Externally-Controlled Input to Select Classes or Code
126 CVEs · 2 exploited
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 2
- check available
- 2
- likely to be exploited
- 5
Every one of the 126 is a mark on the map. Named now: 1 to 26, most at risk first.
- VMware vSphere Client (HTML5) - Remote Code Execution
- PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
- Github Enterprise - Remote Code Execution
- MLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorer
- Unsafe Reflection in base Component class in yiisoft/yii2
- Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserial…
- Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAX
- HTML Cache Poisoning through Unsafe Reflections
- On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Co…
- Remote code execution in HyperSQL DataBase
- Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select C…
- Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.
- A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
- A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
- A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any cl…
- Apache Kylin unsafe class loading
- Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.
- Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Ver…
- Reflex arbitrary method call in stimulus_reflex
- Kiteworks Email Protection Gateway unsafe reflection
- Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
- Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
- Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
Apache4 articles4 articles this week: Attackers exploit N-able N-central flaw to install Monero miners
- Grav before 2.0.9 Remote Code Execution via FlexDirectory
- Craft has a potential authenticated Remote Code Execution via malicious attached Behavior
- In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.