CWE-424

49 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 6High 15Medium 26Low 2Not scored 0

CVEs per yearBy the year they were published

CVE-2024-58136
Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in…
yiiframework · Yii
ExploitedCritical9.0

CVE-2026-112917
Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall
Docker · Docker Desktop
Critical9.2
CVE-2026-121440
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass
bytecodealliance · wasmtime
Medium6.3
CVE-2026-89419
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using…
OpenStack · Ironic
Medium5.0
CVE-2026-114659
Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes
getgrav · grav-plugin-flex-objects
High7.1
CVE-2026-76529
Improper Protection of Alternate Path in Splunk SOAR
Splunk · Splunk SOAR
Critical9.8
CVE-2026-110865
Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets
renovatebot · renovate
High7.1
CVE-2026-69979
Windows AppX Deployment Service Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 21H2
Medium5.5
CVE-2026-107352
Missing authorization checks in Amazon Athena engine version 3 request handling
AWS · Amazon Athena
Medium6.3
CVE-2026-89039
Arbitrary file read via the convert_playwright_script prompt in mcp-k6
Grafana · mcp-k6
Medium6.5
CVE-2026-93353
copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers
9001 · copyparty
Low2.3