CWE-913 · Deserialization and Object Injection
Improper Control of Dynamically-Managed Code Resources
79CVEs
1exploited
3with a public check
4likely (EPSS 10%+)
SortMost likely exploited
79 CVEs with CWE-913 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-68613In CISA KEVExploitedn8n - Remote Code Execution via Expression Injectionn8n-io · n8n · CVSS 10 · 2025-12-19 | 10.0 | 99% | 2025-12-19 |
| CVE-2023-43177CheckCrushFTP < 10.5.1 - Unauthenticated Remote Code ExecutionCrushftp · Crushftp · 2023-11-17 | – | 82% | 2023-11-17 |
| CVE-2026-34156CheckNocoBase - VM Sandbox Escape to Remote Code Executionnocobase · nocobase · CVSS 10 · 2026-03-31 | 10.0 | 35% | 2026-03-31 |
| CVE-2020-15568CheckTerraMaster TOS <.1.29 - Remote Code ExecutionTerra-Master · Tos · 2021-01-30 | – | 29% | 2021-01-30 |
| CVE-2023-29017vm2 Sandbox Escape vulnerabilitypatriksimek · vm2 · CVSS 10 · 2023-04-06 | 10.0 | 63% | 2023-04-06 |
| CVE-2022-36067vm2 vulnerable to Sandbox Escape before v3.9.11patriksimek · vm2 · CVSS 10 · 2022-09-06 | 10.0 | 48% | 2022-09-06 |
| CVE-2023-6184Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site ScriptingCloud Software Group · Citrix Session Recording · CVSS 5 · 2024-01-18 | 5.0 | 47% | 2024-01-18 |
| CVE-2024-7297Langflow Privilege EscalationLangflow · Langflow · CVSS 8.8 · 2024-07-30 | 8.8 | 21% | 2024-07-30 |
| CVE-2017-3202The implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper…Exadel · Flamingo amf-serializer · 2018-06-11 | – | 8.1% | 2018-06-11 |
| CVE-2017-3200The implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code controlGraniteDS · Framework · 2018-06-11 | – | 6.0% | 2018-06-11 |
| CVE-2024-27135Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionApache Software Foundation · Apache Pulsar · CVSS 8.5 · 2024-03-12 | 8.5 | 6.0% | 2024-03-12 |
| CVE-2023-29199vm2 Sandbox escape vulnerabilitypatriksimek · vm2 · CVSS 9.8 · 2023-04-14 | 9.8 | 3.9% | 2023-04-14 |
| CVE-2021-32563An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on…Xfce · Thunar · 2021-05-11 | – | 3.1% | 2021-05-11 |
| CVE-2014-9852distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspecified vectors.Imagemagick · Imagemagick · 2017-03-17 | – | 2.9% | 2017-03-17 |
| CVE-2020-3419Cisco Webex Meetings and Cisco Webex Meetings Server Ghost Join VulnerabilityCisco · Cisco WebEx Meetings Server · CVSS 6.5 · 2020-11-18 | 6.5 | 2.2% | 2020-11-18 |
| CVE-2025-13659Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files…Ivanti · Endpoint Manager · CVSS 8.8 · 2025-12-09 | 8.8 | 2.1% | 2025-12-09 |
| CVE-2019-15006There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate co…Atlassian · Confluence Server · 2019-12-19 | – | 1.9% | 2019-12-19 |
| CVE-2012-2055GitHub Enterprise before 20120304 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the public_key[user…Github · Github · 2012-04-04 | – | 1.8% | 2012-04-04 |
| CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypasspatriksimek · vm2 · CVSS 9.8 · 2026-06-12 | 9.8 | 1.7% | 2026-06-12 |
| CVE-2022-40635Improper Control of Dynamically-Managed Code Resources in Crafter StudioCrafter Software · Crafter CMS · CVSS 6.4 · 2022-09-13 | 6.4 | 1.7% | 2022-09-13 |
| CVE-2022-40634Improper Control of Dynamically-Managed Code Resources in Crafter StudioCrafter Software · Crafter CMS · CVSS 6.4 · 2022-09-13 | 6.4 | 1.6% | 2022-09-13 |
| CVE-2026-25049n8n Has an Expression Escape Vulnerability Leading to RCEn8n-io · n8n · CVSS 9.4 · 2026-02-04 | 9.4 | 1.6% | 2026-02-04 |
| CVE-2019-1617Cisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service VulnerabilityCisco · Nexus 9000 Series Switches in Standalone NX-OS Mode · CVSS 7.4 · 2019-03-11 | 7.4 | 1.3% | 2019-03-11 |
| CVE-2021-26276scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states…Godaddy · Node-Config-Shield · 2021-01-27 | – | 1.2% | 2021-01-27 |
| CVE-2022-25355EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version…EC-CUBE CO.,LTD. · EC-CUBE 3 series and EC-CUBE 4 series · 2022-02-24 | – | 1.2% | 2022-02-24 |
| CVE-2020-25803Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via deep inspection of FreeMarker template exposed objects.Crafter Software · Crafter CMS · CVSS 4.2 · 2020-10-06 | 4.2 | 1.1% | 2020-10-06 |
| CVE-2020-25802Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.Crafter Software · Crafter CMS · CVSS 4.2 · 2020-10-06 | 4.2 | 1.1% | 2020-10-06 |
| CVE-2021-32813Drop Headers via Malicious Connection Headertraefik · traefik · CVSS 4.8 · 2021-08-03 | 4.8 | 1.1% | 2021-08-03 |
| CVE-2022-25265In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20).…Linux · Linux Kernel · 2022-02-16 | – | 1.1% | 2022-02-16 |
| CVE-2026-47208vm2: Sandbox Breakout Using Promise Speciespatriksimek · vm2 · CVSS 10 · 2026-06-12 | 10.0 | 1.0% | 2026-06-12 |
| CVE-2022-3225Improper Control of Dynamically-Managed Code Resources in budibase/budibasebudibase · budibase/budibase · CVSS 8.8 · 2022-09-16 | 8.8 | 1.0% | 2022-09-16 |
| CVE-2025-6384Improper Control of Dynamically-Managed Code Resources in Crafter StudioCrafterCMS · CrafterCMS · CVSS 7.3 · 2025-06-19 | 7.3 | 1.0% | 2025-06-19 |
| CVE-2026-47698vm2: Sandbox Breakout Using Dangerous Host Proto Mutatorspatriksimek · vm2 · CVSS 9.8 · 2026-08-17 | 9.8 | 1.0% | 2026-08-17 |
| CVE-2021-22387There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to remotely…Huawei · EMUI · 2021-08-02 | – | 0.9% | 2021-08-02 |
| CVE-2021-23267Improper Control of Dynamically-Managed Code Resources in Crafter StudioCrafter Software · Crafter CMS · CVSS 7.6 · 2022-05-16 | 7.6 | 0.9% | 2022-05-16 |
| CVE-2023-37271RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapezopefoundation · RestrictedPython · CVSS 8.4 · 2023-07-11 | 8.4 | 0.8% | 2023-07-11 |
| CVE-2022-39051Perl Code execution in Template ToolkitOTRS AG · OTRS · CVSS 6.8 · 2022-09-05 | 6.8 | 0.8% | 2022-09-05 |
| CVE-2023-5763Glassfish remote code executionEclipse Foundation · Glassfish · CVSS 6.8 · 2023-11-03 | 6.8 | 0.8% | 2023-11-03 |
| CVE-2026-92946vm2 before 3.11.7 Remote Code Execution via require.externalpatriksimek · vm2 · CVSS 10 · 2026-09-17 | 10.0 | 0.8% | 2026-09-17 |
| CVE-2025-69219Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperatorApache Software Foundation · Apache Airflow Providers Http · CVSS 8.8 · 2026-03-09 | 8.8 | 0.8% | 2026-03-09 |
| CVE-2026-47131vm2: Sandbox Escapepatriksimek · vm2 · CVSS 10 · 2026-06-12 | 10.0 | 0.8% | 2026-06-12 |
| CVE-2025-25270Remote Code Execution via Unauthenticated Configuration ManipulationPhoenix Contact · CHARX SEC-3150 · CVSS 9.8 · 2025-07-08 | 9.8 | 0.8% | 2025-07-08 |
| CVE-2026-73226Electerm WebSocket `upgrade-func` and `fs` handlers allow arbitrary method/function invocation due to missing method-name allowlistelecterm · electerm · CVSS 8.8 · 2026-08-11 | 8.8 | 0.8% | 2026-08-11 |
| CVE-2021-23259Groovy Sandbox BypassCrafter Software · Crafter CMS · CVSS 4.2 · 2021-12-02 | 4.2 | 0.7% | 2021-12-02 |
| CVE-2021-23258Spring SPEL Expression Language InjectionCrafter Software · Crafter CMS · CVSS 4.2 · 2021-12-02 | 4.2 | 0.7% | 2021-12-02 |
| CVE-2021-21413Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolatelaverdet · isolated-vm · CVSS 8 · 2021-03-30 | 8.0 | 0.7% | 2021-03-30 |
| CVE-2026-92955vm2 before 3.11.8 Sandbox Escape via NodeVMpatriksimek · vm2 · CVSS 10 · 2026-09-17 | 10.0 | 0.7% | 2026-09-17 |
| CVE-2026-71470Acm-search-v2-rhel9: search-v2-operator: search cr imageoverride/arguments/envvar flow unsanitized into pods running impersonating saRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 · CVSS 9.1 · 2026-08-19 | 9.1 | 0.7% | 2026-08-19 |
| CVE-2022-31764Apache ShardingSphere ElasticJob-UI allows RCE via event trace data source JDBCApache Software Foundation · Apache ShardingSphere ElasticJob-UI · CVSS 8.5 · 2025-02-06 | 8.5 | 0.7% | 2025-02-06 |
| CVE-2026-33286Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Namesgraphiti-api · graphiti · CVSS 9.1 · 2026-03-23 | 9.1 | 0.7% | 2026-03-23 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.