CWE-340

CVEs per yearBy the year they were published

1. 20201
2. 20211
3. 20245
4. 202515
5. 202639

Known exploitedNewest addition to KEV first

• CVE-2026-118527

  Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…

  Ivanti · Connect Secure

  ExploitedMedium4.3

Newest CVEs

• CVE-2026-118527

  Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with…

  Ivanti · Connect Secure

  ExploitedMedium4.3
• CVE-2026-85297

  Bucket Squatting in Cloud Run MCP leads to Service Account Takeover

  Google Cloud · Cloud Run MCP

  High7.7
• CVE-2026-79980

  Predictable and reused DHCPv4 transaction identifier allows spoofed DHCP replies to reconfigure gateway and DNS

  zephyrproject · zephyr

  Medium5.6
• CVE-2026-46347

  Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

  intranda · goobi-viewer-core

  Medium6.8
• CVE-2026-46346

  Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

  intranda · goobi-viewer-core

  Medium6.5
• CVE-2026-85496

  Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers

  Botslab · G980H

  High7.7
• CVE-2026-95653

  Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

  concretecms-community-store · community_store

  High8.7
• CVE-2026-64964

  Generation of Predictable Email Confirmation Token in ATutor

  ATutor · ATutor

  Medium6.3
• CVE-2025-14602

  Weak File Name Generation in vsDesk

  vsDesk · vsDesk

  Medium5.3
• CVE-2026-75106

  OpnForm Editable Submission Secret Derivation via Empty Hashids Salt

  OpnForm · OpnForm

  Critical9.3

Vendors it comes up for most

1. TOKUHIROM3
2. CHORNY2
3. Google Cloud2
4. HAYAJO2
5. intranda2
6. ASPEER1
7. ATutor1
8. AWS1
9. B&R Industrial Automation GmbH1
10. BEROV1