CWE-346
869 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 869
- Last 12 months
- 467
- Critical
- 89
- Known exploited
- 2
Critical 89High 292Medium 448Low 37Not scored 3
CVEs per yearBy the year they were published
- 201826
- 20183
- 201921
- 202133
- 20233
- 202442
- 202439
- 202564
- 2026439
- 202673
- 202672
- 202639
Known exploitedNewest addition to KEV first
- CVE-2025-34291
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Langflow · Langflow
ExploitedCritical9.4 - CVE-2015-4495
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin…
Product not named
ExploitedHigh8.8
Newest CVEs
- CVE-2026-120987
Whale Browser before 5.39.412.57 allows an attacker to bypass the iframe sandbox in a dual-tab environment.
NAVER · NAVER Whale browser
Not scored - CVE-2026-105769
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
chainguard · kaniko
Critical9.3 - CVE-2026-74760
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state
Google-Auth
Not scored - CVE-2026-119331
Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
LadybirdBrowser · ladybird
High7.1 - CVE-2026-7005
WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboarding
WIT · SynApps Runtime
Medium5.3 - CVE-2026-119416
CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching
cakephp · cakephp
Medium6.3 - CVE-2026-76026
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…
Google · Chrome
High8.8 - CVE-2026-119285
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
gofiber · fiber
Medium5.9 - CVE-2026-61546
AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP tools
ankimcp · anki-mcp-server-addon
High8.8 - CVE-2026-118657
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
labstack · echo
Medium5.9