CWE-367
943 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 6 of them as exploited in the wild.
- Published CVEs
- 943
- Last 12 months
- 464
- Critical
- 41
- Known exploited
- 6
Critical 41High 484Medium 355Low 61Not scored 2
CVEs per yearBy the year they were published
- 20192
- 20191
- 202046
- 202023
- 20207
- 2024101
- 202465
- 2024113
- 202443
- 20252
- 2026421
- 2026106
Known exploitedNewest addition to KEV first
- CVE-2015-3246
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local…
Product not named
ExploitedHigh7.4 - CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
Linux · Linux
ExploitedHigh7.8 - CVE-2025-22224
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…
VMware · ESXi
ExploitedCritical9.3 - CVE-2024-30088
Windows Kernel Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.0 - CVE-2022-48618
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with…
Apple · tvOS
ExploitedHigh7.0 - CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
ExploitedHigh8.8
Newest CVEs
- CVE-2026-121050
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page.…
Google · Chrome
Not scored - CVE-2026-121245
Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML…
Google · Chrome
Not scored - CVE-2026-121048
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.…
Google · Chrome
High8.8 - CVE-2026-88968
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
anthropics · claude-code
High7.7 - CVE-2026-119977
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Foundation · WordPress
High8.1 - CVE-2026-116250
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
pgadmin.org · pgAdmin 4
High7.3 - CVE-2026-116240
pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
pgadmin.org · pgAdmin 4
High7.1 - CVE-2026-115683
epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
GNOME · Epiphany
Medium6.8 - CVE-2026-119552
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
louislam · uptime-kuma
Medium6.3 - CVE-2026-92374
Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
TeamViewer · Full Client
High7.8