CWE-648

69 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 12High 41Medium 16Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0
CVE-2026-20122
Cisco Catalyst SD-WAN Manager Arbitrary File Overwrite Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedMedium5.4

CVE-2026-112177
Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
Red Hat · Red Hat Enterprise Linux 8
High7.3
CVE-2026-76460
Cisco Identity Services Engine Authentication Bypass Vulnerability
Cisco · Cisco Identity Services Engine Software
ExploitedCritical10.0
CVE-2026-63727
Anchore Enterprise Privilege Escalation via User Management API
Anchore · Anchore Enterprise
High8.7
CVE-2026-54424
An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec…
Unity · Parsec
High8.4
CVE-2026-11877
Missing Authorization Vulnerability in OpenText Access Manager
OpenText · Access Manager
Medium6.3
CVE-2026-9560
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated…
OpenVPN Inc · OpenVPN Connect
Critical9.4
CVE-2026-41225
iControl REST vulnerability
F5 · BIG-IP
High8.6
CVE-2026-41386
OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes
OpenClaw · OpenClaw
Critical9.1
CVE-2026-41329
OpenClaw < 2026.3.31 - Sandbox Bypass via Heartbeat Context Inheritance and senderIsOwner Escalation
OpenClaw · OpenClaw
Critical9.0
CVE-2025-54502
Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (Ring 0) to achieve…
AMD · AMD EPYC™ 9004 Series Processors
High7.1