Skip to content
CVE Tracker

CWE-184

243 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 243 in the listAtom feed of new CVEsWhat CWE-184 is, at MITRE (opens in a new tab)
Published CVEs
243
Last 12 months
186
Critical
38
Known exploited
2

Critical 38High 112Medium 74Low 19Not scored 0

CVEs per yearBy the year they were published

  1. 20171
  2. 20184
  3. 20185
  4. 20182
  5. 20191
  6. 20216
  7. 20213
  8. 202410
  9. 20249
  10. 20257
  11. 2026178
  12. 202617

Known exploitedNewest addition to KEV first

  • CVE-2026-49869

    Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

    kestra-io · kestra

    ExploitedCritical10.0
  • CVE-2024-5217

    Incomplete Input Validation in GlideExpression Script

    ServiceNow · Now Platform

    ExploitedCritical9.2

Newest CVEs

  • CVE-2026-119567

    vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

    vsftpd · vsftpd

    Low2.3
  • CVE-2026-96196

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft · Microsoft Edge (Chromium-based)

    High8.8
  • CVE-2026-117530

    In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

    JetBrains · Junie CLI

    Medium6.7
  • CVE-2026-116339

    iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

    iFlytek · astron-agent

    Medium6.9
  • CVE-2026-115845

    Incomplete validation in the run_script Python sandbox in AWS MCP Server

    AWS · AWS MCP Server

    Medium5.3
  • CVE-2026-115751

    mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

    agentfront · mcp-from-openapi

    Medium6.3
  • CVE-2026-114615

    Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys

    authlib · authlib

    High7.4
  • CVE-2026-114729

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation…

    Roundcube · Webmail

    Medium5.3
  • CVE-2026-114728

    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml…

    Roundcube · Webmail

    Medium5.3
  • CVE-2026-113605

    Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

    Stirling-Tools · Stirling-PDF

    High8.6

Vendors it comes up for most

  1. OpenClaw34
  2. Microsoft9
  3. picklescan7
  4. trailofbits7
  5. Cisco5
  6. AWS4
  7. FasterXML4
  8. FlowiseAI4
  9. JetBrains4
  10. Red Hat4