Skip to content
CVE Tracker

CWE-345

903 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 903 in the listAtom feed of new CVEsWhat CWE-345 is, at MITRE (opens in a new tab)
Published CVEs
903
Last 12 months
426
Critical
111
Known exploited
2

Critical 111High 355Medium 386Low 49Not scored 2

CVEs per yearBy the year they were published

  1. 201713
  2. 201952
  3. 201912
  4. 202012
  5. 202151
  6. 202254
  7. 202372
  8. 202323
  9. 202479
  10. 202553
  11. 2026403
  12. 202669

Known exploitedNewest addition to KEV first

  • CVE-2023-38831

    RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because…

    Product not named

    ExploitedHigh7.8
  • CVE-2022-26871

    An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead…

    Trend Micro · Trend Micro Apex Central

    ExploitedCritical9.8

Newest CVEs

  • CVE-2022-30267

    Emerson Ovation Insufficient Verification of Data Authenticity

    Emerson · Ovation

    High8.7
  • CVE-2026-76894

    CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

    ondata · ckan-mcp-server

    Low3.1
  • CVE-2026-121545

    Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

    robiningelbrecht · dreeve

    Medium6.9
  • CVE-2026-119731

    Munshi Payment Bypass via Unauthenticated Webhook Endpoint

    Petpooja · Munshi

    High8.7
  • CVE-2026-103310

    PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification

    Unknown · PayHere Payment Gateway

    Medium5.3
  • CVE-2026-120317

    http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity

    http4k · http4k

    High8.2
  • CVE-2026-63115

    ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

    TryGhost · ActivityPub

    Medium5.3
  • CVE-2026-119289

    Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

    zuke-build · zuke

    High7.1
  • CVE-2026-119422

    Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connector

    juspay · hyperswitch

    High8.2
  • CVE-2026-93008

    Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

    Red Hat · Red Hat Ceph Storage 9

    Medium6.8

Vendors it comes up for most

  1. Cisco17
  2. Red Hat16
  3. Mozilla13
  4. Microsoft12
  5. Apache Software Foundation11
  6. Google10
  7. OpenClaw9
  8. GitroomHQ7
  9. AMD6
  10. Fortinet6