CWE-1259
20 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 20Published CVEs20 of them scored
- 8Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-16716
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
High8.8 - CVE-2026-117635
Gitea admin API public-only token scope bypass
Gitea · Gitea
Medium6.5 - CVE-2026-76413
Cisco Secure Firewall Management Center Software Single Sign-On Token Forgery of Administrator Account Vulnerability
Cisco · Cisco Secure Firewall Management Center (FMC)
High8.2 - CVE-2026-58429
Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints
Gitea · Gitea Open Source Git Server
Medium4.9 - CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
pterodactyl · panel
High8.1 - CVE-2026-25700
Apache Answer: AdminToken not invalidated after admin deactivation
Apache Software Foundation · Apache Answer
High7.2 - CVE-2026-40264
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation
openbao · openbao
Low2.0 - CVE-2024-29371
In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally…
Product not named
High7.5 - CVE-2025-56676
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary password or reset token issued to one…
Product not named
Medium5.4 - CVE-2025-56207
A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Ethereum ERC721 Non-Fungible Token (NFT)…
Product not named
Medium6.5