CWE-598

CVEs per yearBy the year they were published

1. 20182
2. 20183
3. 20192
4. 20201
5. 20234
6. 20249
7. 20249
8. 20253
9. 202637
10. 202632

Newest CVEs

• CVE-2026-113669

  ApostropheCMS: Cross-domain session token in URL confers session takeover

  apostrophecms · apostrophe

  Medium5.3
• CVE-2026-107370

  Improper Request Handling for Active Directory Logins in auth0-lock

  Auth0 · auth0-lock

  Medium5.3
• CVE-2026-108808

  Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings

  Eleveo · Call Recording Software

  Low2.1
• CVE-2026-107807

  Nginx UI: Node Secret Credential Exposure via URL Query Parameter

  0xJacky · nginx-ui

  High8.8
• CVE-2026-81632

  Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

  team-alembic · ash_authentication_phoenix

  High7.2
• CVE-2026-55375

  canto-saas-api: OAuth credentials exposed in URL query string and exception messages

  jleehr · canto-saas-api

  Medium5.3
• CVE-2026-50157

  Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

  auth0 · symfony

  Medium6.5
• CVE-2026-88897

  Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

  flextype · flextype

  High8.2
• CVE-2026-61614

  SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

  SolidInvoice · SolidInvoice

  Medium5.9
• CVE-2026-82181

  Le-yan｜Medical Practice Management System - Sensitive Data in URL

  Le-yan · Medical Practice Management System

  Medium6.8

Vendors it comes up for most

1. IBM9
2. Dell7
3. Checkmk GmbH3
4. HCL Software3
5. SICK AG3
6. getgrav3
7. Auth02
8. 0xJacky1
9. @apostrophecms1
10. ABB1