Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-668: Exposure of a resource to the wrong sphere

768 published CVEs are weaknesses of this kind, as the records or NVD name it.

All 768 in the listAtom feed of new CVEsWhat CWE-668 is, at MITRE (opens in a new tab)
Published CVEs
768
Last 12 months
98
Critical
74
Known exploited
0

Critical 74High 250Medium 380Low 62Not scored 2

CVEs per yearBy the year they were published

  1. 20131
  2. 20162
  3. 201718
  4. 201826
  5. 201956
  6. 202057
  7. 2021111
  8. 2022139
  9. 2023184
  10. 202446
  11. 202525
  12. 202697

Newest CVEs

  • CVE-2026-102280

    Sandboxie-Plus: Sandbox containment bypass

    sandboxie-plus · Sandboxie

    Medium6.9
  • CVE-2026-121175

    Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium…

    Google · Chrome

    Not scored
  • CVE-2026-121168

    Improper resource exposure in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary…

    Google · Chrome

    High8.8
  • CVE-2026-120308

    Beta9 host filesystem exposure via volume path traversal

    beam-cloud · Beta9 gateway

    Critical9.9
  • CVE-2026-115522

    Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python

    Google · Agent Development Kit (ADK) for Python

    Medium5.3
  • CVE-2026-57144

    PraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable

    MervinPraison · PraisonAI

    High8.8
  • CVE-2026-113126

    Improper resource exposure in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy into a privileged…

    Google · Chrome

    Critical9.6
  • CVE-2026-113328

    Improper resource exposure in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…

    Google · Chrome

    Critical9.6
  • CVE-2026-112936

    filelock: ReadWriteLock follows a symlink at the lock path into SQLite

    tox-dev · filelock

    Medium6.1
  • CVE-2025-10149

    Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover

    WSO2 · WSO2 Identity Server as Key Manager

    High8.2

Vendors it comes up for most

  1. Samsung Mobile28
  2. Google22
  3. Microsoft22
  4. Linux19
  5. Apache Software Foundation17
  6. Dell15
  7. IBM13
  8. Cisco12
  9. NetGain Systems11
  10. Huawei10