CWE-501

35 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 2High 20Medium 12Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2025-61884
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14.…
Oracle Corporation · Oracle Configurator
ExploitedHigh7.5

CVE-2026-62146
Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
Red Hat · Red Hat OpenShift Container Platform 4.16
High7.8
CVE-2026-102709
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports dereference a thread…
Eclipse Foundation · Eclipse ThreadX
High8.4
CVE-2026-54248
Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration
kimdre · doco-cd
Medium6.5
CVE-2026-44091
Creation of a new configuration by posting a malicious ID to MQTT
Phoenix Contact · CHARX SEC-3150
High8.8
CVE-2026-65902
DOMPurify before 3.4.7 Hook Mutation Pollution via allowedTags
cure53 · DOMPurify
Medium5.3
CVE-2026-49458
DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
cure53 · DOMPurify
Medium6.1
CVE-2026-48746
vLLM: OpenAI auth bypass
vllm-project · vllm
Critical9.1
CVE-2026-33828
Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
High7.8
CVE-2026-35051
Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth
traefik · traefik
High7.8
CVE-2026-34780
Electron: Context Isolation bypass via contextBridge VideoFrame transfer
electron · electron
High8.4