CWE-390

CVEs per yearBy the year they were published

1. 20171
2. 20191
3. 20211
4. 20244
5. 20256
6. 202617

Newest CVEs

• CVE-2026-102280

  Sandboxie-Plus: Sandbox containment bypass

  sandboxie-plus · Sandboxie

  Medium6.9
• CVE-2026-122192

  Guest access to Firecracker process memory after a failed memory discard

  AWS · firecracker

  High7.1
• CVE-2026-114137

  Django REST framework: TokenProxy.delete() reports success and revokes nothing

  encode · django-rest-framework

  High7.4
• CVE-2026-111823

  Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.

  Mage · mage-ai

  Critical9.8
• CVE-2026-107275

  @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed

  @fastify/jwt · @fastify/jwt

  Medium6.8
• CVE-2026-104480

  Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

  Discord · libdave

  Critical9.4
• CVE-2026-104002

  Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)

  AWS · powertools-lambda-python

  Medium6.0
• CVE-2026-85716

  AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified

  AsyncHttpClient · async-http-client

  Low3.7
• CVE-2026-29810

  CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

  CyberPanel · CyberPanel

  Medium4.3
• CVE-2026-76642

  util-linux libmount Privilege Escalation via Failed Mount Helper

  util-linux · util-linux

  High8.5

Vendors it comes up for most

1. Red Hat3
2. AWS2
3. Linux2
4. Qualcomm, Inc.2
5. envoyproxy2
6. @fastify/jwt1
7. AMD1
8. Apache Software Foundation1
9. AsyncHttpClient1
10. Cisco1