CWE-341
20 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 20
- Last 12 months
- 10
- Critical
- 5
- Known exploited
- 0
Critical 5High 6Medium 7Low 2Not scored 0
CVEs per yearBy the year they were published
- 20181
- 20191
- 20202
- 20221
- 20242
- 20253
- 202610
Newest CVEs
- CVE-2026-94456
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
GitroomHQ · postiz-app
Critical9.1 - CVE-2026-87913
Missing S3 bucket ownership verification in the AWS Security Agent MCP server
AWS · AWS Security Agent MCP server
Medium5.1 - CVE-2026-87912
Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops
AWS · AWS Security Agent plugin
Medium5.1 - CVE-2026-19565
Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey
Apache-AppSamurai
Low3.7 - CVE-2026-15571
Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
Red Hat · Red Hat build of Keycloak 26.6
High7.3 - CVE-2026-38968
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak…
Product not named
Critical9.8 - CVE-2026-36609
Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source…
Product not named
High7.3 - CVE-2026-5081
Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure
CHORNY · Apache::Session::Generate::ModUniqueId
Critical9.1 - CVE-2026-42365
GeoVision LPC2011/LPC2211 Web Interface guessable session cookie vulnerability
GeoVision Inc. · GV-LPC2011/LPC2211
High8.6 - CVE-2026-40164
jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed
jqlang · jq
High7.5