Use of Incorrectly-Resolved Name or Reference
CWE-706
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
We track 65 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.6. 3 have been exploited in real attacks.
Latest Use of Incorrectly-Resolved Name or Reference vulnerabilities
- 7.5 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: H
- 9.6 Critical severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.1 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity
- 8.6 High severity
Database Tools: Use of Incorrectly-Resolved Name or Reference
MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a rest
- 8.8 High severity
fickling: Deserialization of Untrusted Data
In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is resolved by pickle's find_class through _getattribute to an arbitrary attribute path rather than to a module-level functi
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: H
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: High)
- 9.6 Critical severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 8.4 High severity
vyper: Use of Incorrectly-Resolved Name or Reference
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop va
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTM
- 9.9 Critical severity
server: Use of Incorrectly-Resolved Name or Reference
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encodi
- 7.1 High severity
FileRise: Use of Incorrectly-Resolved Name or Reference
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as
- 8.3 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security s
- 9.1 Critical severity
Gitea: Use of Incorrectly-Resolved Name or Reference
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contribut
- 8.3 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 7.4 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a local attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security se
- 8.8 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- 8.3 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severi
- 7.6 High severity
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix)…
Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an aut
- 7.8 High severity
Notepad++ is a free and open-source source code editor.
Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the Folder as Workspace Run by system action in Notepad++ can resolve a different sibling file than the file selected by the user. When an attacker places a command script whose name is th
- 8.1 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
- 9.9 Critical severity
vm2: Use of Incorrectly-Resolved Name or Reference
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding pac
- 8.1 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Hig
- 8.3 High severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu
- 9.0 Critical severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Medium)
- 9.6 Critical severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 9.6 Critical severity
Chrome: Use of Incorrectly-Resolved Name or Reference
Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 9.1 Critical severity
phpipam: Use of Incorrectly-Resolved Name or Reference
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without includi
- 8.7 High severity
Red Hat Enterprise Linux 10: Use of Incorrectly-Resolved Name or Reference
A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with
- 7.5 High severity
cJSON: Use of Incorrectly-Resolved Name or Reference
cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys b
- 8.1 High severity
filebrowser: Use of Non-Canonical URL Paths for Authorization Decisions
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and Cr
- 8.8 High severity
OpenClaw: Use of Incorrectly-Resolved Name or Reference
OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass dura
- 7.2 High severity
Remote Desktop Manager: Use of Incorrectly-Resolved Name or Reference
Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another us
- 7.5 High severity
UniGetUI: Use of Incorrectly-Resolved Name or Reference
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog pa
- 8.2 High severity
traefik: Use of Incorrectly-Resolved Name or Reference
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, o
- 8.8 High severity
OpenClaw: Use of Incorrectly-Resolved Name or Reference
OpenClaw before 2026.3.22 contains an allowlist bypass vulnerability in system.run approvals that fails to unwrap /usr/bin/time wrappers. Attackers can bypass executable binding restrictions by using an unregistered time wrapper to reuse approval state for inn
- 9.1 Critical severity
fast-jwt: Insufficient Verification of Data Authenticity
fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a custom cacheKeyBuilder method which does not properly create unique keys for different tokens can lead to cache collisions. This could cause tokens to be mis-i