CWE-669
128 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 128
- Last 12 months
- 58
- Critical
- 12
- Known exploited
- 2
Critical 12High 40Medium 54Low 22Not scored 0
CVEs per yearBy the year they were published
- 20021
- 20051
- 20161
- 20171
- 201911
- 202010
- 20219
- 20229
- 20236
- 20244
- 202519
- 202656
Known exploitedNewest addition to KEV first
- CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
Linux · Linux
ExploitedHigh7.8 - CVE-2021-22900
A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a…
Pulse Secure Secure
ExploitedHigh7.2
Newest CVEs
- CVE-2026-123010
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There…
twilio-labs · netlify-okta-auth
High7.2 - CVE-2026-122124
On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data…
Yealink · UVC40 E2
Medium6.1 - CVE-2026-114722
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an…
Roundcube · Webmail
Medium6.5 - CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or…
OpenStack · Cinder
Medium4.3 - CVE-2026-111793
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an…
Openwave Messaging (Ireland) Limited · Webtop Media Transcoder
Medium4.3 - CVE-2026-111445
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=),…
Wheels · Wheels
High8.1 - CVE-2026-110907
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name])…
BackdropCMS · Backdrop
High7.5 - CVE-2026-106555
In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.
OpenBSD · OpenSSH
Low2.2 - CVE-2026-106553
In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.
OpenBSD · OpenSSH
Low2.2 - CVE-2026-47574
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheres. A successful…
NVIDIA · Virtual GPU Manager
High7.8