CWE-915

CVEs per yearBy the year they were published

1. 20191
2. 20201
3. 20215
4. 20224
5. 20235
6. 20246
7. 202516
8. 2026166

Newest CVEs

• CVE-2026-122053

  Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

  sensiolabs · symfony

  Medium6.9
• CVE-2026-123490

  Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass

  craftcms · cms

  High8.7
• CVE-2026-123294

  In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

  JetBrains · Hub

  Critical9.6
• CVE-2026-100361

  SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)

  SuiteCRM · SuiteCRM

  High7.1
• CVE-2026-120448

  DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

  doramart · DoraCMS

  High8.6
• CVE-2026-119565

  Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

  Plausible · Plausible Analytics

  Medium5.3
• CVE-2026-107249

  Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

  Drupal · Block AJAX

  Critical9.8
• CVE-2026-114573

  Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253

  Drupal · Monster Menus

  High8.8
• CVE-2026-90863

  Privilege Escalation via Missing Authorization in WS_FTP Manager

  Progress Software · WS_FTP Server

  Critical9.1
• CVE-2026-118538

  a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes

  a2ui-project · a2ui

  Medium5.1

Vendors it comes up for most

1. Drupal17
2. FlowiseAI14
3. axios7
4. craftcms5
5. FasterXML4
6. TYPO34
7. Apache Software Foundation3
8. Spring3
9. ash-project3
10. danny-avila3