Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-1023

24 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 24 in the listAtom feed of new CVEsWhat CWE-1023 is, at MITRE (opens in a new tab)
Published CVEs
24
Last 12 months
20
Critical
2
Known exploited
1

Critical 2High 5Medium 10Low 7Not scored 0

CVEs per yearBy the year they were published

  1. 20211
  2. 20254
  3. 202619

Known exploitedNewest addition to KEV first

  • CVE-2026-7473

    Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

    Arista Networks · EOS

    ExploitedMedium6.9

Newest CVEs

  • CVE-2026-48057

    Botan: directoryName nameConstraint bypass via multi-AVA RDN flattening in matches_dn

    randombit · botan

    Low2.1
  • CVE-2026-121949

    Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

    sensiolabs · symfony

    Low2.3
  • CVE-2026-121564

    Silent loss of messages when merging overlapping chat exports in whatstk

    lucasrodes · whatstk

    Low1.8
  • CVE-2026-91768

    IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

    PHP Group · PHP

    Medium6.5
  • CVE-2026-85491

    Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone

    Catalyst-Seal

    High8.8
  • CVE-2026-92611

    In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard pattern in a single…

    Eclipse Foundation · Eclipse Ankaios

    Medium4.8
  • CVE-2026-91836

    OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors

    OpenClaw · ClawScan

    Low2.4
  • CVE-2026-54181

    backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

    Laravel-Backpack · CRUD

    Medium5.4
  • CVE-2026-81376

    Visual Studio Code Security Feature Bypass Vulnerability

    Microsoft · Visual Studio Code

    Critical9.6
  • CVE-2026-14199

    Session takeover via Auth Proxy cache key collision

    Grafana · Grafana Enterprise

    High7.1

Vendors it comes up for most

  1. OpenClaw3
  2. Microsoft2
  3. Arista Networks1
  4. BullWall1
  5. Eclipse Foundation1
  6. FreeBSD1
  7. Gallagher1
  8. GitLab1
  9. Grafana1
  10. Laravel-Backpack1