CWE-669: Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Consequences

• Confidentiality, Integrity: Read Application Data, Modify Application Data, Unexpected State

Recent advisories

• GHSA-jf8q-945g-9q4c — vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
• GHSA-mfg3-p6m3-gjgr — OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
• CVE-2026-31431 — crypto: algif_aead - Revert to operating out-of-place
• GHSA-m4f3-qp2w-gwh6 — OpenStack Nova calls qemu-img without format restrictions for resize
• PYSEC-2025-87 — Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
• GHSA-34jh-p97f-mpxf — urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
• GHSA-mq39-4gv4-mvpx — Moby's external DNS requests from 'internal' networks could lead to data exfiltration
• GHSA-6w4q-23cf-j9jp — parse-server's session object properties can be updated by foreign user if object ID is known
• GHSA-9j3m-g383-29qr — OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
• GHSA-x24j-87x9-jvv5 — Publify `guest` role users can self-register even when the admin does not allow it
• CVE-2021-22900 — A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a…
• GHSA-36xw-fx78-c5r4 — containerd-shim API Exposed to Host Network Containers

All advisories for CWE-669