CWE-1259
19 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 19
- Last 12 months
- 7
- Critical
- 1
- Known exploited
- 0
Critical 1High 4Medium 11Low 2Not scored 1
CVEs per yearBy the year they were published
- 20222
- 20244
- 20257
- 20266
Newest CVEs
- CVE-2026-117635
Gitea admin API public-only token scope bypass
Gitea · Gitea
Not scored - CVE-2026-76413
Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
High8.2 - CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Gitea · Gitea Open Source Git Server
Medium4.9 - CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
pterodactyl · panel
High8.1 - CVE-2026-25700
Apache Answer: AdminToken not invalidated after admin deactivation
Apache Software Foundation · Apache Answer
High7.2 - CVE-2026-40264
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
openbao · openbao
Low2.0 - CVE-2024-29371
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally…
Product not named
High7.5 - CVE-2025-56676
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one…
Product not named
Medium5.4 - CVE-2025-56207
A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT)…
Product not named
Medium6.5 - CVE-2024-4598
Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator
WSO2 · WSO2 API Manager
Medium6.5