Skip to content
CVE Tracker

CWE-668: Exposure of a resource to the wrong sphere

767 published CVEs are weaknesses of this kind, as the records or NVD name it.

All 767 in the listAtom feed of new CVEsWhat CWE-668 is, at MITRE (opens in a new tab)
Published CVEs
767
Last 12 months
97
Critical
74
Known exploited
0

Critical 74High 250Medium 379Low 62Not scored 2

CVEs per yearBy the year they were published

  1. 20191
  2. 202044
  3. 202274
  4. 20222
  5. 20227
  6. 202318
  7. 2024162
  8. 2024126
  9. 202533
  10. 2025127
  11. 202689
  12. 202629

Newest CVEs

  • CVE-2026-121175

    Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium…

    Google · Chrome

    Not scored
  • CVE-2026-121168

    Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary…

    Google · Chrome

    High8.8
  • CVE-2026-120308

    Beta9 host filesystem exposure via volume path traversal

    beam-cloud · Beta9 gateway

    Critical9.9
  • CVE-2026-115522

    Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python

    Google · Agent Development Kit (ADK) for Python

    Medium5.3
  • CVE-2026-57144

    PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

    MervinPraison · PraisonAI

    High8.8
  • CVE-2026-113126

    Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged…

    Google · Chrome

    Critical9.6
  • CVE-2026-113328

    Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

    Google · Chrome

    Critical9.6
  • CVE-2026-112936

    filelock: ReadWriteLock follows a symlink at the lock path into SQLite

    tox-dev · filelock

    Medium6.1
  • CVE-2025-10149

    Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

    WSO2 · WSO2 Identity Server as Key Manager

    High8.2
  • CVE-2026-104073

    NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links

    netbox-community · netbox

    Medium6.9

Vendors it comes up for most

  1. Samsung Mobile28
  2. Google22
  3. Microsoft22
  4. Linux19
  5. Apache Software Foundation17
  6. Dell15
  7. IBM13
  8. Cisco12
  9. NetGain Systems11
  10. Huawei10