CWE-807

CVEs per yearBy the year they were published

1. 20171
2. 20201
3. 20213
4. 20222
5. 20234
6. 20248
7. 202523
8. 202694

Known exploitedNewest addition to KEV first

• CVE-2026-34486

  Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  Apache Software Foundation · Apache Tomcat

  ExploitedHigh7.5
• CVE-2026-21514

  Microsoft Word Security Feature Bypass Vulnerability

  Microsoft · Microsoft 365 Apps for Enterprise

  ExploitedHigh7.8
• CVE-2026-21509

  Microsoft Office Security Feature Bypass Vulnerability

  Microsoft · Microsoft 365 Apps for Enterprise

  ExploitedHigh7.8

Newest CVEs

• CVE-2026-77463

  Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment

  umputun · remark42

  Medium6.5
• CVE-2026-119148

  Unvalidated parent-supplied AWS Region in AWS aws-nitro-enclaves-sdk-c allows impersonation of the enclave's AWS KMS endpoint

  AWS · aws-nitro-enclaves-sdk-c

  High8.2
• CVE-2026-116016

  yudao-cloud through 2026.09 Data Permission Bypass via data-permission-enable Header

  YunaiV · yudao-cloud

  High7.1
• CVE-2026-114617

  Authlib: ID token can disable its own nonce validation via the nonce_supported claim

  authlib · authlib

  Medium4.2
• CVE-2026-50106

  Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent.

  NLnet Labs · Unbound

  Medium6.5
• CVE-2026-111748

  AIOHTTP: Absolute-form request targets can spoof Request.scheme

  aio-libs · aiohttp

  Medium6.3
• CVE-2026-111869

  makeplane API Endpoint reliance on untrusted inputs in a security decision

  makeplane · plane

  Medium6.9
• CVE-2026-108433

  Microsoft Office Word Security Feature Bypass Vulnerability

  Microsoft · Microsoft 365 Apps for Enterprise

  High7.8
• CVE-2026-110726

  In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element…

  Eclipse Foundation · Eclipse Connected Services Platform

  Medium6.5
• CVE-2026-53614

  util-linux LIBMOUNT_FORCE_MOUNT2 allows nosuid and noexec bypass

  util-linux · util-linux

  High7.0

Vendors it comes up for most

1. OpenClaw12
2. Microsoft11
3. AWS2
4. Apache Software Foundation2
5. Checkmk GmbH2
6. DogukanUrker2
7. Eclipse Foundation2
8. Google2
9. IBM2
10. MongoDB2