CWE-830 · Supply Chain and Malicious Code
Inclusion of Web Functionality from an Untrusted Source
12CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
12 CVEs with CWE-830 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-29944An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects De…Mozilla · Firefox · CVSS 8.4 · 2024-03-22 | 8.4 | 4.7% | 2024-03-22 |
| CVE-2023-2588Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cl…Teltonika · Remote Management System · CVSS 8.8 · 2023-05-22 | 8.8 | 1.1% | 2023-05-22 |
| CVE-2021-28162In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.The Eclipse Foundation · Eclipse Theia · 2021-03-12 | – | 0.8% | 2021-03-12 |
| CVE-2024-42381os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a…No vendor recorded · CVSS 8.3 · 2024-07-31 | 8.3 | 0.6% | 2024-07-31 |
| CVE-2026-97358Inclusion of Web Functionality from an Untrusted Source on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplusB. Braun Melsungen AG · SpaceCom · CVSS 7 · 2026-11-13 | 7.0 | 0.5% | 2026-11-13 |
| CVE-2025-33028In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to bypass the Mark-of-t…WinZip · WinZip · CVSS 6.1 · 2025-04-15 | 6.1 | 0.5% | 2025-04-15 |
| CVE-2025-46652In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not p…IZArc · IZArc · CVSS 6.1 · 2025-04-26 | 6.1 | 0.3% | 2025-04-26 |
| CVE-2025-65109Minder does not sandbox http.send in Rego programsmindersec · minder · CVSS 8.5 · 2025-11-21 | 8.5 | 0.3% | 2025-11-21 |
| CVE-2025-33027In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affe…Bandisoft · Bandizip · CVSS 6.1 · 2025-04-15 | 6.1 | 0.3% | 2025-04-15 |
| CVE-2025-33026In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected insta…PeaZip · PeaZip · CVSS 6.1 · 2025-04-15 | 6.1 | 0.3% | 2025-04-15 |
| CVE-2024-35180OMERO.web JSONP callback vulnerabilityome · omero-web · CVSS 6.1 · 2024-05-21 | 6.1 | 0.3% | 2024-05-21 |
| CVE-2025-43703An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker-controlled access to the internal API (even though the attacker has no knowle…Ankitects · Anki · CVSS 6.1 · 2025-04-16 | 6.1 | 0.2% | 2025-04-16 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.