CWE-1025
22 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 22
- Last 12 months
- 16
- Critical
- 2
- Known exploited
- 0
Critical 2High 11Medium 8Low 1Not scored 0
CVEs per yearBy the year they were published
- 20241
- 20255
- 202616
Newest CVEs
- CVE-2026-114649
Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
MongoDB · C# Driver
High7.6 - CVE-2026-104048
Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation
Red Hat · Red Hat Enterprise Linux 10
Medium6.8 - CVE-2026-100248
The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.
Rattadan · Cosmowarp Contract
High8.4 - CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparison handling
Brocade · SANnav
Medium6.9 - CVE-2026-79677
Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Apache Software Foundation · Apache Tomcat
High7.5 - CVE-2026-93854
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id}…
OpenStack · Blazar
High7.2 - CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias")…
CyberPanel · CyberPanel
High7.7 - CVE-2023-54390
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
pmmp · PocketMine-MP
High8.7 - CVE-2026-78619
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically
Punk-TOTP
Critical9.8 - CVE-2026-75840
ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex
ArcadeData · arcadedb
High8.7