Skip to content
CVE Tracker

CWE-203

839 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 839 in the listAtom feed of new CVEsWhat CWE-203 is, at MITRE (opens in a new tab)
Published CVEs
839
Last 12 months
149
Critical
24
Known exploited
1

Critical 24High 125Medium 588Low 97Not scored 5

CVEs per yearBy the year they were published

  1. 20192
  2. 20202
  3. 20216
  4. 20233
  5. 20231
  6. 2024110
  7. 202559
  8. 202599
  9. 2025108
  10. 202575
  11. 2026126
  12. 2026134

Known exploitedNewest addition to KEV first

  • CVE-2024-39891

    In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain…

    Product not named

    ExploitedMedium5.3

Newest CVEs

  • CVE-2026-121130

    Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-121138

    Observable discrepancy in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium…

    Google · Chrome

    Not scored
  • CVE-2026-121223

    Observable discrepancy in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium…

    Google · Chrome

    Not scored
  • CVE-2026-121187

    Observable discrepancy in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page.…

    Google · Chrome

    Not scored
  • CVE-2026-114199

    Gitea contribution heatmap private activity disclosure to public-only tokens

    Gitea · Gitea

    Not scored
  • CVE-2026-118338

    Observable discrepancy in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.…

    Google · Chrome

    High8.8
  • CVE-2026-118312

    Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML…

    Google · Chrome

    Critical9.6
  • CVE-2026-65626

    Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

    potatosalad · jose

    Medium5.9
  • CVE-2026-76406

    Information Disclosure through REST API Authentication in Splunk SOAR

    Splunk · Splunk SOAR

    Medium5.9
  • CVE-2026-114064

    Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint

    grokability · snipe-it

    Medium5.1

Vendors it comes up for most

  1. Google103
  2. IBM25
  3. Mozilla24
  4. Red Hat11
  5. AMD9
  6. Honor9
  7. wolfSSL9
  8. Apple8
  9. Jenkins Project8
  10. Oracle Corporation8