Skip to content
CVE Tracker

CWE-697

192 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 192 in the listAtom feed of new CVEsWhat CWE-697 is, at MITRE (opens in a new tab)
Published CVEs
192
Last 12 months
56
Critical
21
Known exploited
2

Critical 21High 70Medium 93Low 8Not scored 0

CVEs per yearBy the year they were published

  1. 20111
  2. 20171
  3. 202020
  4. 20202
  5. 202324
  6. 20231
  7. 202418
  8. 202434
  9. 202424
  10. 20243
  11. 20259
  12. 202654

Known exploitedNewest addition to KEV first

  • CVE-2024-5217

    Incomplete Input Validation in GlideExpression Script

    ServiceNow · Now Platform

    ExploitedCritical9.2
  • CVE-2020-5849

    Unraid 6.8.0 allows authentication bypass.

    Product not named

    ExploitedHigh7.5

Newest CVEs

  • CVE-2026-115732

    Certificate Name Authorization Bypass

    Perforce · Puppet Enterprise

    Critical9.0
  • CVE-2026-104198

    ZoneMinder failed token handling bypasses web authentication

    ZoneMinder · zoneminder

    Medium5.3
  • CVE-2026-108969

    itsmeravitejak Online-Examination-System Session session.php checkLogin comparison

    itsmeravitejak · Online-Examination-System

    Medium6.9
  • CVE-2026-106252

    Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…

    Google · Chrome

    High8.8
  • CVE-2026-71892

    CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

    Legion of the Bouncy Castle Inc. · BC-JAVA

    Medium6.9
  • CVE-2026-101913

    ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

    beaugunderson · ip-address

    Medium6.3
  • CVE-2026-101912

    ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

    beaugunderson · ip-address

    Medium6.3
  • CVE-2026-85292

    InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

    InvoicePlane · InvoicePlane

    Medium4.8
  • CVE-2026-79913

    Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

    cloudreve · cloudreve

    Medium6.5
  • CVE-2026-93957

    olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison

    olivier-ls · PHP-FTS

    Medium5.3

Vendors it comes up for most

  1. Jenkins Project7
  2. SolarWinds5
  3. tensorflow5
  4. GitHub4
  5. simpleledger4
  6. D-Link3
  7. IBM3
  8. Juniper Networks3
  9. Red Hat3
  10. Apache Software Foundation2