CWE-470 (CWE-470) — 11 disclosed vulnerabilities

Records the NVD classes under CWE-470, highest CVSS first.

CRITICAL 9.8CVE-2026-78030public PoC2026-09-19
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a …
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-704102026-09-22
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Clas…
AI risk analysis on Exploit-DB.ai →
HIGH 8.8CVE-2026-86792public PoC2026-09-16
Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field into Python callables via `import_string`, with no allowlist, and hand them to the confluent-kafka client which invokes th…
apache-airflow-providers-apache-kafka
AI risk analysis on Exploit-DB.ai →
HIGH 8.5CVE-2026-921262026-09-16
Jenkins Script Security Plugin 1415.v9a_f9b_3a_c253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute…
script security
AI risk analysis on Exploit-DB.ai →
HIGH 8.4CVE-2026-76825public PoC2026-09-16
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library s…
AI risk analysis on Exploit-DB.ai →
HIGH 8.2CVE-2026-1012922026-09-28
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol …
AI risk analysis on Exploit-DB.ai →
HIGH 7.6CVE-2026-181232026-09-22
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.
AI risk analysis on Exploit-DB.ai →
HIGH 7.3CVE-2026-662692026-09-17
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnera…
AI risk analysis on Exploit-DB.ai →
HIGH 7.2CVE-2026-60202026-08-05
The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directl…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.5CVE-2026-96740public PoC2026-09-28
A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR aut…
AI risk analysis on Exploit-DB.ai →
MEDIUM 6.4CVE-2026-96672public PoC2026-09-23
Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-white…
AI risk analysis on Exploit-DB.ai →