CWE-749 Exposed Dangerous Method or Function
Description
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-749 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-r9v2-gg2j-22q5 | CVE-2026-105848 | MODERATE |
Payload: Insufficient Access Control in Stripe REST Proxy |
2026-10-06 | |
| GHSA-q8hw-4fvp-9rwv | CVE-2026-61793 | MODERATE |
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter |
2026-09-17 | |
| GHSA-9w56-46f6-3qhx | - | MODERATE |
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter |
2026-08-20 | |
| GHSA-wf6j-gr27-g7ch | CVE-2024-45747 | HIGH |
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates |
2026-08-19 | |
| GHSA-g8mr-85jm-7xhm | CVE-2026-53633 | CRITICAL |
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE |
2026-08-13 | |
| GHSA-g2r8-wvmj-jf5w | CVE-2026-54753 | MODERATE |
`nx graph` dev server permissive CORS policy |
2026-07-31 | |
| GHSA-f5vj-f2hx-8m93 | CVE-2026-14620 | MODERATE |
webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints |
2026-07-20 | |
| GHSA-9hfw-w3f4-c4p8 | CVE-2026-41283 | CRITICAL |
OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed |
2026-07-14 | |
| GHSA-6m52-m754-pw2g | CVE-2026-45670 | MODERATE |
Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) |
2026-07-08 | |
| GHSA-7ppg-37fh-vcr6 | CVE-2026-26190 | CRITICAL |
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise |
2026-07-06 | |
| GHSA-x6qj-4h56-5rj5 | CVE-2026-49993 | MODERATE |
@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) |
2026-06-16 | |
| GHSA-3q2w-42mv-cph4 | CVE-2025-52903 | HIGH |
filebrowser Allows Shell Commands to Spawn Other Commands |
2026-06-09 | |
| GHSA-p3hx-pwf3-j8wr | CVE-2026-44798 | HIGH |
Nautobot: GitRepository.current_head field should not be writable through REST API |
2026-06-09 | |
| GHSA-7f3r-gwc9-2995 | CVE-2026-44836 | MODERATE |
view_component: Preview Route Can Dispatch Inherited Helper Methods |
2026-06-08 | |
| GHSA-22qr-rp27-j9wm | CVE-2026-45805 | HIGH |
PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE |
2026-05-19 | |
| GHSA-79cf-xcqc-c78w | CVE-2026-6402 | MODERATE |
webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins |
2026-05-18 | |
| GHSA-jw8q-gjvg-8w4q | CVE-2026-30957 | CRITICAL |
OneUptime has Synthetic Monitor RCE via exposed Playwright browser object |
2026-03-10 | |
| GHSA-4j36-39gm-8vq8 | CVE-2026-30921 | CRITICAL |
OneUptime: Synthetic Monitor RCE via exposed Playwright browser object |
2026-03-10 | |
| GHSA-vxw4-wv6m-9hhh | CVE-2026-22812 | HIGH |
OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution |
2026-01-13 | |
| GHSA-6fg3-hvw7-2fwq | CVE-2025-9611 | HIGH |
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools |
2026-01-07 | |
| GHSA-j4p8-h8mh-rh8q | CVE-2025-68697 | HIGH |
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write |
2025-12-31 | |
| GHSA-46gc-mwh4-cc5r | CVE-2025-64443 | HIGH |
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode |
2025-12-03 | |
| GHSA-7qwv-cwgj-c8rj | CVE-2006-1547 | HIGH |
Improper Input Validation in Apache Struts |
2025-10-22 | |
| GHSA-4v9v-hfq4-rm2v | CVE-2025-30359 | MODERATE |
webpack-dev-server users' source code may be stolen when they access a malicious web site |
2025-10-03 | |
| GHSA-7835-fcv3-g256 | CVE-2024-55924 | HIGH | - |
TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery |
2025-05-21 |