CWE-914

CVEs per yearBy the year they were published

1. 20231
2. 20242
3. 20252
4. 20264

Newest CVEs

• CVE-2019-25777

  YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution

  YAML

  High7.3
• CVE-2026-44006

  vm2: Sandbox Escape

  patriksimek · vm2

  Critical10.0
• CVE-2026-35173

  Chyrp Lite has an IDOR via Mass Assignment in Post Model

  xenocrat · chyrp-lite

  Medium6.5
• CVE-2026-34444

  Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

  scoder · lupa

  High7.9
• CVE-2025-14085

  youlaitech youlai-mall orders improper control of dynamically-identified variables

  youlaitech · youlai-mall

  Medium5.3
• CVE-2025-14051

  youlaitech youlai-mall addresses deleteAddress improper control of dynamically-identified variables

  youlaitech · youlai-mall

  Medium5.3
• CVE-2024-54198

  Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

  SAP_SE · SAP NetWeaver Application Server ABAP

  High8.5
• CVE-2024-24914

  Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is…

  checkpoint · ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management

  High8.0
• CVE-2023-33175

  ToUI allows user-specific variables to be shared between users

  mubarakalmehairbi · ToUI

  Critical9.1

Vendors it comes up for most

1. youlaitech2
2. SAP_SE1
3. checkpoint1
4. mubarakalmehairbi1
5. patriksimek1
6. scoder1
7. xenocrat1