CWE-706
174 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.
- Published CVEs
- 174
- Last 12 months
- 89
- Critical
- 27
- Known exploited
- 3
Critical 27High 67Medium 67Low 12Not scored 1
CVEs per yearBy the year they were published
- 20183
- 202011
- 202014
- 202210
- 20237
- 202417
- 202515
- 202512
- 20251
- 202684
Known exploitedNewest addition to KEV first
- CVE-2025-24813
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Software Foundation · Apache Tomcat
ExploitedCritical10.0 - CVE-2021-40539
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Product not named
ExploitedCritical9.8 - CVE-2020-15505
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0…
Product not named
ExploitedCritical9.8
Newest CVEs
- CVE-2026-121200
Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially…
Google · Chrome
Critical9.6 - CVE-2026-121133
Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process…
Google · Chrome
Not scored - CVE-2026-119675
mongorestore may bypass collection guards through a system.buckets prefix
MongoDB · Database Tools
Medium5.2 - CVE-2026-118938
Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis
trailofbits · fickling
High8.8 - CVE-2026-119270
Incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to…
Google · Chrome
High8.8 - CVE-2026-119266
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to…
Google · Chrome
High8.8 - CVE-2026-119265
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to execute…
Google · Chrome
High8.8 - CVE-2026-118309
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain…
Google · Chrome
Critical9.6 - CVE-2026-118314
Incorrect reference resolution in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a local attacker leveraging social engineering to obtain…
Google · Chrome
High8.8 - CVE-2026-89313
JwksTrustStore.Get returns the last fetched JWKS key (err=nil) when the requested kid is absent, instead of nil
Eclipse Foundation · Eclipse KeyPont - GOSE
Medium6.3