CWE-837

CVEs per yearBy the year they were published

1. 20234
2. 20242
3. 20258
4. 20266

Newest CVEs

• CVE-2026-112285

  Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

  Thelia · Thelia

  Medium5.3
• CVE-2026-105850

  Payload: Order confirmation validation issue in Payload Ecommerce

  payloadcms · payload

  High8.8
• CVE-2026-86198

  PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket

  pmmp · PocketMine-MP

  Low2.3
• CVE-2026-45734

  MyBB: Default CAPTCHA missing invalidation

  mybb · mybb

  Medium5.3
• CVE-2026-42609

  Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic

  getgrav · grav

  High8.1
• CVE-2026-44601

  Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.

  torproject · Tor

  Low3.7
• CVE-2025-62784

  InventoryGui allows item duplication in GUIs which use GuiStorageElement

  Phoenix616 · InventoryGui

  Medium5.3
• CVE-2025-62783

  InventoryGui affected by item duplication in GUIs which use GuiStorageElement

  Phoenix616 · InventoryGui

  Medium5.0
• CVE-2025-62782

  InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement

  Phoenix616 · InventoryGui

  Medium5.9
• CVE-2025-54315

  The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.

  Matrix · Matrix specification

  High7.1

Vendors it comes up for most

1. Phoenix6163
2. Thecosy3
3. CTFd2
4. @payloadcms1
5. Issuetrak1
6. Matrix1
7. Red Hat1
8. Thelia1
9. Zoom Communications, Inc1
10. getgrav1