CWE-471

CVEs per yearBy the year they were published

1. 20186
2. 20208
3. 20213
4. 20226
5. 20233
6. 20241
7. 20256
8. 202612

Newest CVEs

• CVE-2026-63402

  i18next: Shared built-in corruption through inherited-key deepExtend recursion

  i18next · i18next

  Medium5.9
• CVE-2026-54610

  LibreDWG: const-input mutation and crash in bit_TV_to_utf8 error handling

  LibreDWG · libredwg

  Low3.3
• CVE-2026-118780

  Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

  digitalbazaar · forge

  Low3.7
• CVE-2026-107296

  msgpack5: Decoding negative int64 values mutates the input buffer

  mcollina · msgpack5

  Low3.7
• CVE-2026-103001

  PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse

  jpadilla · pyjwt

  Medium6.5
• CVE-2026-92949

  vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

  patriksimek · vm2

  Medium6.3
• CVE-2026-84664

  Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to…

  Jenkins Project · Jenkins GitLab Plugin

  Medium5.4
• CVE-2026-59299

  Composition lookup can potentially poison base function in Spring Cloud Function

  Spring · Spring Cloud Function

  Low3.1
• CVE-2026-50481

  Azure Active Directory Elevation of Privilege Vulnerability

  Microsoft · Azure Active Directory

  Critical9.9
• CVE-2026-54267

  Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

  angular · angular

  High8.6

Vendors it comes up for most

1. HackerOne5
2. IBM3
3. Siemens2
4. ABB1
5. AzeoTech1
6. Drupal1
7. Exasol1
8. GitLab1
9. Google LLC1
10. HID Global1