CWE-420
41 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 41
- Last 12 months
- 14
- Critical
- 6
- Known exploited
- 2
Critical 6High 15Medium 15Low 5Not scored 0
CVEs per yearBy the year they were published
- 20201
- 20221
- 20237
- 20247
- 202514
- 202611
Known exploitedNewest addition to KEV first
- CVE-2025-54309
CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers…
CrushFTP · CrushFTP
ExploitedCritical9.0 - CVE-2023-20198
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list…
Cisco · Cisco IOS XE Software
ExploitedCritical10.0
Newest CVEs
- CVE-2026-105008
Windows Schannel Spoofing Vulnerability
Microsoft · Windows 10 Version 1607
Critical9.0 - CVE-2026-102134
Kiteworks Core Unprotected Alternate Channel
Kiteworks · Core
Medium5.4 - CVE-2026-61909
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to…
cyrusimap · Cyrus IMAP
Low3.5 - CVE-2026-77639
Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream…
torproject · Tor
Medium5.3 - CVE-2026-40435
BIG-IP httpd access control vulnerability
F5 · BIG-IP
Medium6.9 - CVE-2026-43505
An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access…
Prosody · Prosody
Medium6.5 - CVE-2026-40217
LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
BerriAI · LiteLLM
High8.8 - CVE-2026-35388
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
OpenBSD · OpenSSH
Low2.5 - CVE-2026-25916
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
Roundcube · Webmail
Medium4.3 - CVE-2025-41727
Beckhoff: Performing privileged operations and gaining administrator access
Beckhoff Automation · Beckhoff.Device.Manager.XAR
High7.8