CWE-470— Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.— MITRE CWE catalog
154 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-470page 4 of 4
- CVE-2026-54614MEDIUMCVSS 4.3EG 4.32026-08-26
DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes …
- CVE-2026-57284MEDIUMCVSS 4.3EG 4.32026-06-24
Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline Snippet Generator, allowing attackers to instantiate types related to job or system configuration othe…
- CVE-2026-115749LOWCVSS 3.3EG 3.32026-10-23
hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling config…
- CVE-2022-23744LOWCVSS 2.3EG 2.32022-07-07
Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator.
Map vulnerabilities like CWE-470 to your infrastructure
EchelonGraph correlates every CVE — across CWE-470 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →