CWE-1188
389 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.
- Published CVEs
- 389
- Last 12 months
- 167
- Critical
- 116
- Known exploited
- 5
Critical 116High 158Medium 101Low 11Not scored 3
CVEs per yearBy the year they were published
- 201720
- 201818
- 201929
- 202028
- 202120
- 202217
- 202322
- 202429
- 202549
- 2026157
Known exploitedNewest addition to KEV first
- CVE-2025-48927
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…
TeleMessage · service
ExploitedMedium5.3 - CVE-2023-27524
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Apache Software Foundation · Apache Superset
ExploitedHigh8.9 - CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics · VisiLogic
ExploitedCritical9.8 - CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
Apache Software Foundation · Apache CouchDB
ExploitedCritical9.8 - CVE-2020-13927
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who…
Apache Airflow
ExploitedCritical9.8
Newest CVEs
- CVE-2026-122006
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g.,…
rubyonrails · Active Storage
Critical9.8 - CVE-2026-95860
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
node-opcua · node-opcua
Critical9.1 - CVE-2026-120091
Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
Temporal Technologies, Inc. · Temporal Server
High8.7 - CVE-2026-78192
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page
WebDyne
Not scored - CVE-2026-116247
pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
pgadmin.org · pgAdmin 4
High7.1 - CVE-2026-116244
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
pgadmin.org · pgAdmin 4
High7.1 - CVE-2026-116242
pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
pgadmin.org · pgAdmin 4
High7.1 - CVE-2026-112255
Endpoint credential minting (insecure default allow-list)
OpenText · Advanced Authentication Server
Low2.9 - CVE-2026-118691
xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message
GuDong2003 · xianyu-auto-reply-fix
Medium6.3 - CVE-2026-116273
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion
MIME-tools
Not scored