Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-829

388 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 3 of them as exploited in the wild.

All 388 in the listAtom feed of new CVEsWhat CWE-829 is, at MITRE (opens in a new tab)
Published CVEs
388
Last 12 months
214
Critical
68
Known exploited
3

Critical 68High 226Medium 83Low 10Not scored 1

CVEs per yearBy the year they were published

  1. 20042
  2. 20101
  3. 20172
  4. 201811
  5. 201916
  6. 202012
  7. 202126
  8. 202222
  9. 202321
  10. 202424
  11. 202547
  12. 2026204

Known exploitedNewest addition to KEV first

  • CVE-2026-111357

    Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…

    Ivanti · Connect Secure

    ExploitedHigh7.0
  • CVE-2026-0770

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    Langflow · Langflow

    ExploitedCritical9.8
  • CVE-2025-32463

    Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

    Sudo project · Sudo

    ExploitedCritical9.3

Newest CVEs

  • CVE-2026-122160

    myshell-ai AIlice HuggingFace Model Wrapper AModelCausalLM.py LoadModel_PEFT inclusion of functionality from untrusted control sphere

    myshell-ai · AIlice

    Medium5.3
  • CVE-2026-122135

    Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program

    mistralai · mistral-vibe

    High8.6
  • CVE-2026-122134

    Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers

    mistralai · mistral-vibe

    High8.6
  • CVE-2026-95649

    IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution

    I.R.I.S S.A. · IRISPowerscan

    Medium6.1
  • CVE-2026-63184

    Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

    christianhelle · refitter

    High7.1
  • CVE-2026-118762

    Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN

    monkeytypegame · monkeytype

    Critical9.3
  • CVE-2023-7357

    FlexNet Publisher lmadmin Rogue Vendor Daemon Vulnerability

    Revera · FlexNet Publisher

    High8.6
  • CVE-2026-114488

    Wildfly: wildfly-iiop: wildfly-ejb3: wildfly: authentication bypass on iiop ejb invocations as csiv2 ittprincipalname accepted without transport binding

    Red Hat · Red Hat Fuse 7

    High7.4
  • CVE-2026-15564

    Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization

    Red Hat · Red Hat JBoss Enterprise Application Platform 7

    High7.4
  • CVE-2026-84725

    Openjdk-orb: incomplete fix for cve-2026-15560,unauthed class loading via iiop in eap

    Red Hat · Red Hat JBoss Enterprise Application Platform 7

    High8.1

Vendors it comes up for most

  1. Microsoft14
  2. JetBrains13
  3. OpenClaw11
  4. IBM9
  5. Red Hat8
  6. Eclipse Foundation6
  7. MervinPraison6
  8. Mozilla6
  9. The Eclipse Foundation6
  10. gradle6