cve.bz

CWE-706: Use of Incorrectly-Resolved Name or Reference

Filter

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

What the weakness is: CWE-706 at MITRE. All weaknesses

Related attack patterns (CAPEC): 4
  • CAPEC-48 Passing Local Filenames to Functions That Expect a URL Likelihood: High · Severity: High
  • CAPEC-159 Redirect Access to Libraries Likelihood: High · Severity: Very High
  • CAPEC-177 Create files with the same name as files protected with a higher classification Severity: Very High
  • CAPEC-641 DLL Side-Loading Likelihood: Low · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-706, as MITRE names them. Credits.

Ask an AI about CWE-706

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-706: Use of Incorrectly-Resolved Name or Reference and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/706.html and https://cve.bz/cve/cwe/706?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-18484EPSS 0.5%

    IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions.

  2. 9.6CVE-2026-121200EPSS 0.4%

    Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit…

  3. 8.1CVE-2026-121133EPSS 0.3%

    Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chrom…

  4. 5.2CVE-2026-119675EPSS 0.2%

    MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace fi…

  5. 8.8CVE-2026-118938EPSS 0.5%

    In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to …

  6. 8.8CVE-2026-119270EPSS 0.2%

    Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity:…

  7. 8.8CVE-2026-119266EPSS 0.3%

    Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium…

  8. 8.8CVE-2026-119265EPSS 0.2%

    Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium securit…

  9. 8.8CVE-2026-118314EPSS 0.2%

    Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: High)

  10. 9.6CVE-2026-118309EPSS 0.3%

    Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)

  11. 6.3CVE-2026-89313EPSS 0.3%

    `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cache. When the requested `kid` was not present, the trailing naked `return` handed the caller the last key in the JWKS docume…

  12. 8.6CVE-2026-114663EPSS 0.2%

    Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's paramet…

  13. 3.1CVE-2026-14288EPSS 0.3%

    GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that under certain conditions could have allowed an authenticated to bypass a required merge request app…

  14. 6.5CVE-2026-113223EPSS 0.4%

    Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit…

  15. 6.5CVE-2026-113159EPSS 0.4%

    Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  16. 6.5CVE-2026-113102EPSS 0.4%

    Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  17. 8.8CVE-2026-113034EPSS 0.5%

    Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sand…

  18. 6.1CVE-2026-112909EPSS 0.2%

    filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard…

  19. 9.9CVE-2026-92262EPSS 1.5%

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-n…

  20. 7.1CVE-2026-61844EPSS 0.3%

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so dis…

  21. 8.3CVE-2026-110156EPSS 0.3%

    Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension.…

  22. 5.4CVE-2026-78359EPSS 0.2%

    OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multiple backends, such as a database and LDAP, are configured, the uniqueness check for customer user ema…

  23. 6.4CVE-2026-107822EPSS 0.5%

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user na…

  24. 9.1CVE-2026-95106EPSS 0.3%

    Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use …

  25. 8.3CVE-2026-106409EPSS 0.3%

    Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic…

  26. 4.3CVE-2026-106325EPSS 0.2%

    Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  27. 8.8CVE-2026-106308EPSS 0.3%

    Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: …

  28. 7.4CVE-2026-106279EPSS 0.09%

    Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. …

  29. 8.8CVE-2026-106274EPSS 0.3%

    Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Mediu…

  30. 5.3CVE-2026-106230EPSS 0.3%

    Incorrect reference resolution in Offline in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security …

  31. 5.3CVE-2026-106181EPSS 0.3%

    Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Med…

  32. 8.3CVE-2026-95334EPSS 0.3%

    Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chr…

  33. 6.5CVE-2026-95275EPSS 0.3%

    Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  34. 7.6CVE-2026-87720EPSS 0.3%

    Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through…

  35. 8.8CVE-2026-85491EPSS 0.4%

    Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepare_action…

  36. 7.8CVE-2026-77605EPSS 0.2%

    Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command sc…

  37. 8.1CVE-2026-93375EPSS 0.1%

    Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

  38. 9.4CVE-2026-92951EPSS 0.5%

    vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requ…

  39. 8.1CVE-2026-91727EPSS 0.1%

    Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium s…

  40. 2.7CVE-2026-88621EPSS 0.3%

    OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's…

  41. 2.7CVE-2026-25825EPSS 0.3%

    An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user (with admin acces…

  42. 8.3CVE-2026-87618EPSS 0.4%

    Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML…

  43. 9.0CVE-2026-87613EPSS 0.5%

    Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)

  44. 4.3CVE-2026-87562EPSS 0.2%

    Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

  45. 9.6CVE-2026-87547EPSS 0.5%

    Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secur…

  46. 7.4CVE-2026-81383EPSS 0.9%

    Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  47. 4.3CVE-2026-79273EPSS 0.3%

    Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  48. 4.3CVE-2026-79264EPSS 0.3%

    Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  49. 4.3CVE-2026-79254EPSS 0.2%

    Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  50. 3.1CVE-2026-79103EPSS 0.3%

    Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)