CWE-749

CWE-749 · 8 records · 5 with a public proof-of-concept

Records the NVD classes under CWE-749, highest CVSS first.

  1. CRITICAL 10CVE-2026-77521public PoC2026-09-21

    MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on,…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 8.8CVE-2026-252552026-09-22

    Exposed dangerous function lead to privilege escalation via gRPC server.

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 7.2CVE-2026-18901public PoC2026-08-05

    A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has bee…

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 5.6CVE-2026-861572026-09-29

    Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI…

    AI risk analysis on Exploit-DB.ai →

  5. UNSCOREDCVE-2026-964302026-09-29

    Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter.

    AI risk analysis on Exploit-DB.ai →

  6. UNSCOREDCVE-2026-89139public PoC2026-09-21

    Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program…

    AI risk analysis on Exploit-DB.ai →

  7. UNSCOREDCVE-2026-92612public PoC2026-09-21

    In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an in…

    AI risk analysis on Exploit-DB.ai →

  8. UNSCOREDCVE-2026-61793public PoC2026-09-17

    Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fo…

    AI risk analysis on Exploit-DB.ai →