Skip to content
CVE Tracker

CWE-602

183 published CVEs are weaknesses of this kind, as the records or NVD name it.

All 183 in the listAtom feed of new CVEsWhat CWE-602 is, at MITRE (opens in a new tab)
Published CVEs
183
Last 12 months
99
Critical
19
Known exploited
0

Critical 19High 52Medium 104Low 8Not scored 0

CVEs per yearBy the year they were published

  1. 20142
  2. 20172
  3. 20214
  4. 20226
  5. 20223
  6. 202412
  7. 202543
  8. 202521
  9. 202690

Newest CVEs

  • CVE-2026-89293

    Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

    Eclipse Foundation · Eclipse Mnestix

    High8.8
  • CVE-2026-117554

    Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

    admidio · admidio

    Medium5.3
  • CVE-2026-116605

    SourceCodester Online Food Ordering System order.php client-side enforcement of server-side security

    SourceCodester · Online Food Ordering System

    Medium6.9
  • CVE-2026-110314

    WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

    mtrudel · bandit

    Medium6.3
  • CVE-2026-89206

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for…

    Siemens · RUGGEDCOM CROSSBOW

    Medium5.3
  • CVE-2026-89205

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for…

    Siemens · RUGGEDCOM CROSSBOW

    Medium5.3
  • CVE-2026-13138

    Improper Authorization in Divasoft Software's Biletiva Ticketing Platform

    Divasoft Software and E-Commerce Inc. · Biletiva Ticketing Platform

    High8.6
  • CVE-2026-100306

    TDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement

    TDuckCloud · tduck-survey-form

    Medium6.9
  • CVE-2026-77320

    TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)

    mauriceboe · TREK

    Medium5.3
  • CVE-2026-82189

    Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

    j2commerce.com · J2Store extension for Joomla

    High8.7

Vendors it comes up for most

  1. Google44
  2. IBM16
  3. Siemens7
  4. Cisco6
  5. Dell6
  6. Fortinet5
  7. Ivanti3
  8. Accuenergy2
  9. Cognex2
  10. Gallagher2