CWE-349

CVEs per yearBy the year they were published

1. 20181
2. 20191
3. 20202
4. 20211
5. 20234
6. 20247
7. 202513
8. 202624

Newest CVEs

• CVE-2026-59263

  Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.

  Apache Software Foundation · Apache OpenOffice

  Low1.9
• CVE-2026-117656

  Unverified Sign in with Apple callback parameter can override verified ID token claims

  pow-auth · assent

  Critical9.3
• CVE-2026-112256

  Logon bypass (trust of attacker-controlled completed-methods list)

  OpenText · Advanced Authentication Server

  Critical9.2
• CVE-2026-102527

  Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes

  nuxt-modules · og-image

  Medium6.9
• CVE-2026-100755

  Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab

  GitLab · GitLab

  Medium4.6
• CVE-2026-48100

  Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages

  polybase · payy

  High8.7
• CVE-2026-95985

  Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces

  Amazon · Kiro IDE

  High8.6
• CVE-2026-62364

  wlc may disclose API tokens to project-configured URLs

  WeblateOrg · wlc

  Low2.3
• CVE-2026-19033

  Unauthenticated IXFR deltas are applied to the live zone before TSIG verification

  ISC · BIND 9

  Medium6.5
• CVE-2026-78301

  Out-of-zone database nodes can become authoritative zone cuts

  ISC · BIND 9

  Medium5.8

Vendors it comes up for most

1. Microsoft5
2. ISC4
3. NLnet Labs4
4. JetBrains3
5. GitLab2
6. nuxt2
7. Amazon1
8. Apache Software Foundation1
9. Cisco1
10. Dell1