Skip to content
CVE Tracker

CWE-640

351 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

All 351 in the listAtom feed of new CVEsWhat CWE-640 is, at MITRE (opens in a new tab)
Published CVEs
351
Last 12 months
134
Critical
111
Known exploited
1

Critical 111High 137Medium 95Low 7Not scored 1

CVEs per yearBy the year they were published

  1. 20181
  2. 202016
  3. 20202
  4. 20201
  5. 202224
  6. 20235
  7. 202434
  8. 202531
  9. 2026111
  10. 202647
  11. 202621
  12. 202613

Known exploitedNewest addition to KEV first

  • CVE-2023-7028

    Weak Password Recovery Mechanism for Forgotten Password in GitLab

    GitLab · GitLab

    ExploitedCritical10.0

Newest CVEs

  • CVE-2026-119127

    ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection

    zitadel · zitadel

    High8.6
  • CVE-2026-116214

    MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

    maccmspro · maccms10

    Critical9.3
  • CVE-2026-94380

    Host Header Injection in HAVELSAN's Liman MYS

    HAVELSAN Inc. · Liman MYS

    High8.1
  • CVE-2026-115973

    FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery

    FaveoSuite · Faveo Helpdesk

    Medium6.9
  • CVE-2026-58202

    OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation`

    open-reception · appointment-booking-software

    High8.3
  • CVE-2026-46347

    Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset

    intranda · goobi-viewer-core

    Medium6.8
  • CVE-2026-46346

    Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset

    intranda · goobi-viewer-core

    Medium6.5
  • CVE-2026-86055

    Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover

    Part-DB · Part-DB-server

    High8.7
  • CVE-2026-43845

    A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.

    Advantech · ADAM-3600

    Critical9.2
  • CVE-2026-112035

    aircheng-org iWebShop-5 simple.php send_message_mobile password recovery

    aircheng-org · iWebShop-5

    Medium5.3

Vendors it comes up for most

  1. Oracle Corporation10
  2. Dell4
  3. zitadel4
  4. GitLab3
  5. AVideo2
  6. Apple2
  7. Birebirsoft Software and Technology Solutions2
  8. D-Link2
  9. Esri2
  10. Hitachi Vantara2