By weakness (CWE)

CWE-829: related vulnerabilities

CVEs classified under CWE-829. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

6 published vulnerabilities

• CVE-2026-44358HIGH 8.2

  Espressif's Shared GitHub DangerJS Action, a reusable CI workflow component, contains a privilege escalation vulnerability in versions prior to 1.0.1. When processing pull requests from forks, the action's entrypoint script executes DangerJS from an untrusted search path after copying fork code into the working directory. This allows fork-supplied code to run inside the action container with the permissions of the workflow, rather than the action's own trusted code. An attacker can exploit this by submitting a malicious pull request from a fork, causing arbitrary code execution in the CI/CD environment.

• CVE-2022-49036HIGH 7.8

  Synology Active Backup for Business Recovery Media Creator versions prior to 2.5.0-2081 contain a flaw where untrusted OpenSSL configuration can be loaded during operation. A local user with standard privileges can exploit this to execute arbitrary code on the system. The vulnerability stems from the application trusting configuration from a location or source that should not be trusted, creating a path for privilege escalation or lateral movement within an affected environment.

• CVE-2022-49042HIGH 7.8

  Synology Hyper Backup Explorer contains a vulnerability that allows authenticated local users to execute arbitrary code through a flaw in how the MinGW DLL component handles untrusted libraries or code. An attacker with local access to a system running vulnerable versions can leverage this weakness to run malicious code with the privileges of the user running the application, potentially compromising data or system integrity.

• CVE-2026-47292HIGH 7.8

  Visual Studio Code contains a flaw that allows an attacker with local access to run malicious code with elevated privileges. The vulnerability stems from the application loading or executing functionality from untrusted sources, which an attacker can exploit if they can trick a user into interacting with a malicious file or extension. This is a local privilege escalation risk that requires user interaction but poses a significant threat to developers and organizations relying on VS Code for secure development workflows.

• CVE-2026-8879HIGH 7.5

  The Securly Chrome Extension version 3.0.7 contains a critical availability issue where a content script (content13.min.js) is loaded dynamically at runtime instead of being declared upfront in the extension's manifest file. This hidden script blanks out all web pages and displays a full-page overlay while it waits for Securly's servers to verify whether the page is safe. If Securly's servers cannot be reached or become unresponsive, affected users see nothing but a blank page with no way to access content—effectively breaking browsing until the service recovers or the extension is disabled.

• CVE-2026-11269HIGH 7.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in how the browser handles extensions that allows an attacker positioned on the same network as a user to execute arbitrary code within Chrome's sandbox. The attacker must craft a malicious extension and the user must interact with it (such as installing or clicking something), making this a moderate-complexity attack. While Chromium rated this as low severity internally, the CVSS assessment reflects the potential for complete compromise of the sandboxed process.