Skip to content
CVE Tracker

CWE-472

167 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 167 in the listAtom feed of new CVEsWhat CWE-472 is, at MITRE (opens in a new tab)
Published CVEs
167
Last 12 months
116
Critical
15
Known exploited
1

Critical 15High 84Medium 63Low 5Not scored 0

CVEs per yearBy the year they were published

  1. 20172
  2. 20191
  3. 20201
  4. 20221
  5. 20229
  6. 20248
  7. 20243
  8. 202530
  9. 2026112

Known exploitedNewest addition to KEV first

  • CVE-2025-35939

    Craft CMS stores user-provided content in session files

    Craft · CMS

    ExploitedMedium6.9

Newest CVEs

  • CVE-2026-115450

    Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

    MarcosCamara01 · Ecommerce Template

    High7.1
  • CVE-2026-16453

    Mattermost SAML RelayState forgery allows unauthorized team membership

    Mattermost · Mattermost

    High7.1
  • CVE-2026-111447

    Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to…

    Wheels · Wheels

    High8.1
  • CVE-2026-77470

    Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request

    LycheeOrg · Lychee

    High8.3
  • CVE-2026-55384

    InvoiceShelf trusts client-supplied document totals

    InvoiceShelf · InvoiceShelf

    Medium5.3
  • CVE-2026-103671

    External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be…

    EC-CUBE CO.,LTD. · AmazonPay V2 Plugin (4.0/4.1 series)

    Medium5.3
  • CVE-2026-103080

    WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability

    VillaTheme · Salevo

    Medium5.3
  • CVE-2026-107636

    pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController

    ph7software · ph7builder

    High7.1
  • CVE-2026-107363

    In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the…

    OpenStack · Zaqar

    Medium6.1
  • CVE-2026-105322

    Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form

    Unknown · Magee Shortcodes

    Medium5.3

Vendors it comes up for most

  1. Google79
  2. Cisco7
  3. SAP_SE3
  4. BlueWave2
  5. Cambium Networks2
  6. HCL Software2
  7. Red Hat2
  8. Sylius2
  9. j2commerce.com2
  10. ABIS Technology Ltd. Co.1