CWE-522

1,579 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.

Critical 240High 553Medium 721Low 64Not scored 1

CVEs per yearBy the year they were published

CVE-2021-22681
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are…
Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers
ExploitedCritical9.8
CVE-2021-30116
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Product not named
ExploitedCritical10.0
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found…
Product not named
ExploitedCritical9.8
CVE-2017-9248
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect…
Product not named
ExploitedCritical9.8
CVE-2014-1812
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server…
Product not named
ExploitedHigh8.8

CVE-2026-113733
Password hash disclosure to "view only" admin users with custom user models
djangoproject · Django
Low2.1
CVE-2026-89292
Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures
Eclipse Foundation · Eclipse Mnestix
Critical9.2
CVE-2026-105769
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
chainguard · kaniko
Critical9.3
CVE-2026-116252
pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
pgadmin.org · pgAdmin 4
High7.1
CVE-2026-116247
pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
pgadmin.org · pgAdmin 4
High7.1
CVE-2026-116245
pgAdmin 4: Connection services are not restricted in server mode
pgadmin.org · pgAdmin 4
High7.1
CVE-2026-116244
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
pgadmin.org · pgAdmin 4
High7.1
CVE-2026-116242
pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
pgadmin.org · pgAdmin 4
High7.1
CVE-2026-61730
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
socfortress · CoPilot
Critical9.3
CVE-2026-111502
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote…
Dell · OpenManage Enterprise
Medium4.3