CWE-470 · Command and Code Injection
Use of Externally-Controlled Input to Select Classes or Code
126CVEs
2exploited
2with a public check
5likely (EPSS 10%+)
SortMost likely exploited
126 CVEs with CWE-470 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-21985In CISA KEVExploitedVMware vSphere Client (HTML5) - Remote Code ExecutionVMware · VMware vCenter Server and VMware Cloud Foundation · CVSS 9.8 · 2021-05-26 | 9.8 | 100% | 2021-05-26 |
| CVE-2026-82078In CISA KEVExploitedPaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorPaperCut · PaperCut MF/NG · CVSS 9.4 · 2026-08-28 | 9.4 | 63% | 2026-08-28 |
| CVE-2024-0200CheckGithub Enterprise - Remote Code ExecutionGitHub · Enterprise Server · CVSS 7.2 · 2024-01-16 | 7.2 | 72% | 2024-01-16 |
| CVE-2026-115886CheckMLflow <3.17.0 - Unauthenticated SSRF via Third-Party (TruLens) Scorermlflow · mlflow · CVSS 6.5 · 2026-10-23 | 6.5 | 0.7% | 2026-10-23 |
| CVE-2024-4990Unsafe Reflection in base Component class in yiisoft/yii2yiisoft · yiisoft/yii2 · CVSS 8.1 · 2025-03-20 | 8.1 | 80% | 2025-03-20 |
| CVE-2022-30287Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. This then leads to arbitrary deserial…Horde · Groupware · 2022-07-28 | – | 69% | 2022-07-28 |
| CVE-2025-3600Unsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXProgress Software · Telerik UI for ASP.NET AJAX · CVSS 7.5 · 2025-05-14 | 7.5 | 26% | 2025-05-14 |
| CVE-2025-53693HTML Cache Poisoning through Unsafe ReflectionsSitecore · Sitecore Experience Manager (XM) · CVSS 9.8 · 2025-09-03 | 9.8 | 20% | 2025-09-03 |
| CVE-2018-5511On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Co…F5 Networks, Inc. · BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Contro… · 2018-04-13 | – | 14% | 2018-04-13 |
| CVE-2022-41853Remote code execution in HyperSQL DataBaseHyperSQL DataBase · hsqldb · CVSS 8 · 2022-10-06 | 8.0 | 5.1% | 2022-10-06 |
| CVE-2018-1000613Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select C…Bouncycastle · Bc-Java · 2018-07-09 | – | 4.8% | 2018-07-09 |
| CVE-2022-23744Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.Checkpoint · Enterprise Endpoint Security Windows Clients. · 2022-07-07 | – | 4.6% | 2022-07-07 |
| CVE-2019-1003041A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.Jenkins project · Jenkins Pipeline: Groovy Plugin · 2019-03-28 | – | 3.4% | 2019-03-28 |
| CVE-2019-1003040A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.Jenkins project · Jenkins Script Security Plugin · 2019-03-28 | – | 3.4% | 2019-03-28 |
| CVE-2019-10174A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any cl…Infinispan · infinispan · CVSS 7.5 · 2019-11-25 | 7.5 | 3.1% | 2019-11-25 |
| CVE-2021-31522Apache Kylin unsafe class loadingApache Software Foundation · Apache Kylin · 2022-01-06 | – | 3.0% | 2022-01-06 |
| CVE-2023-33652Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.Sitecore · Experience Platform · CVSS 8.8 · 2023-06-06 | 8.8 | 2.5% | 2023-06-06 |
| CVE-2023-6943Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 Ver…Mitsubishi Electric Corporation · EZSocket · CVSS 9.8 · 2024-01-30 | 9.8 | 2.1% | 2024-01-30 |
| CVE-2024-28121Reflex arbitrary method call in stimulus_reflexstimulusreflex · stimulus_reflex · CVSS 8.8 · 2024-03-12 | 8.8 | 1.6% | 2024-03-12 |
| CVE-2026-102094Kiteworks Email Protection Gateway unsafe reflectionKiteworks · Email Protection Gateway · CVSS 7.2 · 2026-09-30 | 7.2 | 1.5% | 2026-09-30 |
| CVE-2026-86792Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationApache Software Foundation · Apache Airflow Apache Kafka provider · CVSS 8.8 · 2026-09-16 | 8.8 | 1.2% | 2026-09-16 |
| CVE-2026-33157Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms · cms · CVSS 8.6 · 2026-03-24 | 8.6 | 1.1% | 2026-03-24 |
| CVE-2026-90436Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionNameApache Software Foundation · Apache Axis 1.x (EOL) · CVSS 9.8 · 2026-11-06 | 9.8 | 1.1% | 2026-11-06 |
| CVE-2026-65608Grav before 2.0.9 Remote Code Execution via FlexDirectorygetgrav · grav · CVSS 8.8 · 2026-07-23 | 8.8 | 1.1% | 2026-07-23 |
| CVE-2026-25498Craft has a potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms · cms · CVSS 8.6 · 2026-02-09 | 8.6 | 1.1% | 2026-02-09 |
| CVE-2025-63690In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java…Pig4cloud · Pig · CVSS 9.1 · 2025-11-07 | 9.1 | 1.1% | 2025-11-07 |
| CVE-2020-7857A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of improper classes. Th…Tobesoft · XPlatform · CVSS 7.5 · 2021-04-20 | 7.5 | 1.0% | 2021-04-20 |
| CVE-2019-3834It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable…RedHat · struts · CVSS 5.6 · 2019-10-03 | 5.6 | 1.0% | 2019-10-03 |
| CVE-2026-44795Spinnaker: Non-safe yaml deserialization allowing RCE when using specific typesspinnaker · spinnaker · CVSS 8.8 · 2026-07-10 | 8.8 | 1.0% | 2026-07-10 |
| CVE-2025-68455Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms · cms · CVSS 8.6 · 2026-01-05 | 8.6 | 1.0% | 2026-01-05 |
| CVE-2019-20635codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.Intland · Codebeamer · 2020-04-02 | – | 0.9% | 2020-04-02 |
| CVE-2024-6096Unsafe Deserialization VulnerabilityProgress Software Corporation · Telerik Reporting · CVSS 8.8 · 2024-07-24 | 8.8 | 0.9% | 2024-07-24 |
| CVE-2026-63317Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XMLApache Software Foundation · Apache OpenNLP · CVSS 5.6 · 2026-07-24 | 5.6 | 0.9% | 2026-07-24 |
| CVE-2024-8015Telerik Report Server Insecure Type ResolutionProgress Software · Telerik Reporting · CVSS 9.1 · 2024-10-09 | 9.1 | 0.8% | 2024-10-09 |
| CVE-2026-55559Yamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)yamcs · yamcs · CVSS 9.8 · 2026-08-28 | 9.8 | 0.8% | 2026-08-28 |
| CVE-2025-12967An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function th…AWS · JDBC Wrapper · CVSS 8 · 2025-11-10 | 8.0 | 0.8% | 2025-11-10 |
| CVE-2026-6020ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST APIdevitemsllc · ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin · CVSS 7.2 · 2026-08-05 | 7.2 | 0.8% | 2026-08-05 |
| CVE-2026-17593Nexus Repository - Arbitrary Class Instantiation via Unsafe Realm ConfigurationSonatype · Nexus Repository · CVSS 7.2 · 2026-08-07 | 7.2 | 0.8% | 2026-08-07 |
| CVE-2025-34393Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCEBarracuda Networks · RMM · CVSS 10 · 2025-12-10 | 10.0 | 0.8% | 2025-12-10 |
| CVE-2023-37207A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion…Mozilla · Firefox · 2023-07-05 | – | 0.7% | 2023-07-05 |
| CVE-2026-13181RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXProgress Software · Telerik UI for ASP.NET AJAX · CVSS 8.1 · 2026-07-22 | 8.1 | 0.7% | 2026-07-22 |
| CVE-2026-42027Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderApache Software Foundation · Apache OpenNLP · CVSS 9.8 · 2026-05-04 | 9.8 | 0.7% | 2026-05-04 |
| CVE-2026-16306CVE-2026-16306INFINITT Healthcare · System Manager · CVSS 9.8 · 2026-11-02 | 9.8 | 0.7% | 2026-11-02 |
| CVE-2004-2331ColdFusion MX 6.1 and 6.1 J2EE allows local users to bypass sandbox security restrictions and obtain sensitive information by using Java reflection methods to access trusted Java…Macromedia · Coldfusion · 2005-08-16 | – | 0.7% | 2005-08-16 |
| CVE-2026-79987Low-privilege RCE through element-search eager loadingcraftcms · cms · CVSS 8.8 · 2026-09-10 | 8.8 | 0.6% | 2026-09-10 |
| CVE-2026-70410Apache Calcite Avatica: Unrestricted class initialization when instantiating pluginsApache Software Foundation · Apache Calcite Avatica · CVSS 8.8 · 2026-09-22 | 8.8 | 0.6% | 2026-09-22 |
| CVE-2023-32217SailPoint IdentityIQ Unsafe use of Reflection VulnerabilitySailPoint · IdentityIQ · CVSS 9 · 2023-05-31 | 9.0 | 0.6% | 2023-05-31 |
| CVE-2026-58659PyTorch Lightning Arbitrary Code Execution via _instantiator HyperparameterLightning-AI · pytorch-lightning · CVSS 7.8 · 2026-07-15 | 7.8 | 0.6% | 2026-07-15 |
| CVE-2024-8014Telerik Reporting EntityDataSource Insecure Type ResolutionProgress Software · Telerik Reporting · CVSS 8.8 · 2024-10-09 | 8.8 | 0.6% | 2024-10-09 |
| CVE-2026-97666Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository EndpointSonatype · Nexus Repository 3 · CVSS 6.9 · 2026-10-15 | 6.9 | 0.6% | 2026-10-15 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.