CWE-696

54 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 1High 16Medium 29Low 8Not scored 0

CVEs per yearBy the year they were published

CVE-2026-82898
Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in
Apache Software Foundation · Apache Wicket
Low2.1
CVE-2026-65219
Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
SMCI · MBD-X12SPI
High7.4
CVE-2026-114145
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
gitpython-developers · GitPython
High7.5
CVE-2026-73535
Gitea second-factor bypass through OpenID identity linking
Gitea · Gitea
High8.8
CVE-2026-110450
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content…
NixOS · Nix
High8.0
CVE-2026-109162
TYPO3 CMS - Security Misconfiguration in Form Framework
TYPO3 · TYPO3 CMS
Medium6.3
CVE-2026-26287
External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration
external-secrets · external-secrets
High7.1
CVE-2026-105745
Docling: Plugin entry points are imported before the allow_external_plugins check
docling-project · docling
Medium6.7
CVE-2026-103353
WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability
WP ManageNinja LLC · FluentForm
Medium5.3
CVE-2026-103012
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid…
Anthropic · @anthropic-ai/claude-code
Low2.0