CWE-441
232 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 232
- Last 12 months
- 186
- Critical
- 25
- Known exploited
- 1
Critical 25High 117Medium 84Low 6Not scored 0
CVEs per yearBy the year they were published
- 20171
- 20182
- 20194
- 20201
- 20216
- 20223
- 20232
- 20244
- 202534
- 2026175
Known exploitedNewest addition to KEV first
- CVE-2026-83548
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…
SonicWall · SMA1000
ExploitedCritical10.0
Newest CVEs
- CVE-2026-121198
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…
Google · Chrome
High8.8 - CVE-2026-121171
Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…
Google · Chrome
High8.8 - CVE-2026-121108
Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML…
Google · Chrome
High8.8 - CVE-2026-49906
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the…
Google · Android
High7.8 - CVE-2026-59028
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of…
Google · Android
High8.4 - CVE-2026-59015
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional…
Google · Android
Medium4.0 - CVE-2026-59000
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional…
Google · Android
High8.4 - CVE-2026-58970
In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of…
Google · Android
High8.4 - CVE-2026-58965
In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of…
Google · Android
High8.4 - CVE-2026-58957
In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to…
Google · Android
High8.4