CWE-290
830 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 7 of them as exploited in the wild.
- Published CVEs
- 830
- Last 12 months
- 383
- Critical
- 156
- Known exploited
- 7
Critical 156High 270Medium 375Low 29Not scored 0
CVEs per yearBy the year they were published
- 20091
- 201810
- 20191
- 202129
- 2025107
- 2026332
- 2026113
- 202682
- 202656
- 202645
- 202634
- 202619
Known exploitedNewest addition to KEV first
- CVE-2026-102764
Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
BeyondTrust · Remote Support
ExploitedCritical9.3 - CVE-2026-104935
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
Ivanti · Connect Secure
ExploitedHigh8.6 - CVE-2023-50224
TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability
TP-Link · TL-WR841N
ExploitedMedium6.5 - CVE-2024-54085
Redfish Authentication Bypass
AMI · MegaRAC-SPx
ExploitedCritical10.0 - CVE-2024-4358
Registration Authentication Bypass Vulnerability
Progress Software Corporation · Telerik Report Server
ExploitedCritical9.8 - CVE-2022-24112
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
Apache Software Foundation · Apache APISIX
ExploitedCritical9.8 - CVE-2022-23131
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML
Zabbix · Frontend
ExploitedCritical9.1
Newest CVEs
- CVE-2026-91896
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with…
Dell · Alienware Command Center (AWCC)
Low3.9 - CVE-2026-117656
Unverified Sign in with Apple callback parameter can override verified ID token claims
pow-auth · assent
Critical9.3 - CVE-2026-63115
ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts
TryGhost · ActivityPub
Medium5.3 - CVE-2026-104623
Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
SUSE · Rancher
Medium6.3 - CVE-2026-104615
Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
SUSE · Rancher
High7.9 - CVE-2026-119703
xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header
xinnan-tech · xiaozhi-esp32-server
Medium6.3 - CVE-2026-91914
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent…
Dell · OpenManage Enterprise
High7.1 - CVE-2026-119425
OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
opnsense · core
Medium5.3 - CVE-2026-115962
WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability
myCred · myCred
Medium4.3 - CVE-2026-118653
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
labstack · echo
Medium5.3