CWE-646

CVEs per yearBy the year they were published

1. 20211
2. 20243
3. 20254
4. 20262

Newest CVEs

• CVE-2026-45315

  Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions

  open-webui · open-webui

  High8.7
• CVE-2026-20172

  Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability

  Cisco · Cisco Enterprise Chat and Email

  Medium4.3
• CVE-2025-30662

  Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following

  Zoom Communications Inc. · Zoom Workplace VDI Plugin macOS Universal installer

  Medium6.6
• CVE-2025-41720

  Sauter: Arbitrary File Upload

  Sauter · modulo 6 devices modu680-AS

  Medium4.3
• CVE-2025-58449

  Maho Vulnerable to Authenticated Remote Code Execution via File Upload

  MahoCommerce · maho

  High8.7
• CVE-2025-1889

  picklescan - Security scanning bypass via non-standard file extensions

  mmaitre314 · picklescan

  Medium5.3
• CVE-2024-52052

  Stream Target Remote Code Execution in Wowza Streaming Engine

  Wowza · Streaming Engine

  Critical9.4
• CVE-2024-38432

  Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File

  Matrix · Tafnit v8

  Medium5.5
• CVE-2023-45599

  A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote…

  AiLux · imx6 bundle

  Medium5.5
• CVE-2021-34639

  WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File Upload

  W3 Eden, Inc. · WordPress Download Manager

  High7.5

Vendors it comes up for most

1. AiLux1
2. Cisco1
3. MahoCommerce1
4. Matrix1
5. Sauter1
6. W3 Eden, Inc.1
7. Wowza1
8. Zoom Communications Inc.1
9. mmaitre3141
10. open-webui1