CWE-1188
393 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.
- 393Published CVEs392 of them scored
- 171Last 12 monthspublished in the last year
- 117Critical161 more rated high
- 5Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2025-48927
The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the wild in…
TeleMessage · service
ExploitedMedium5.3 - CVE-2023-27524
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Apache Software Foundation · Apache Superset
ExploitedHigh8.9 - CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics · VisiLogic
ExploitedCritical9.8 - CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
Apache Software Foundation · Apache CouchDB
ExploitedCritical9.8 - CVE-2020-13927
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who…
Apache Airflow
ExploitedCritical9.8