CWE-636
79 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 79
- Last 12 months
- 66
- Critical
- 14
- Known exploited
- 0
Critical 14High 29Medium 27Low 9Not scored 0
CVEs per yearBy the year they were published
- 20212
- 20235
- 20244
- 20252
- 202666
Newest CVEs
- CVE-2026-109408
vault-java-driver: SslConfig silently disables requested TLS verification
jopenlibs · vault-java-driver
High7.4 - CVE-2026-102280
Sandboxie-Plus: Sandbox containment bypass
sandboxie-plus · Sandboxie
Medium6.9 - CVE-2026-95860
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
node-opcua · node-opcua
Critical9.1 - CVE-2026-109593
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing…
SonicWall · Global Management System (GMS)
Critical9.1 - CVE-2026-110985
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Apache Software Foundation · Apache Kafka
Critical9.1 - CVE-2026-108142
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Veeam · Backup and Replication
Critical9.1 - CVE-2026-105933
Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
Apache Software Foundation · Apache Pulsar
Low2.3 - CVE-2026-114479
Not Failing Securely ('Failing Open') in hMailServer
Progressive Robot Ltd · hMailServer
Medium5.8 - CVE-2026-74048
Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Apache Software Foundation · Apache Tomcat
Medium6.5 - CVE-2026-103502
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
hexpm · hex_core
Medium5.9