CWE-1270
10 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 10Published CVEs10 of them scored
- 5Last 12 monthspublished in the last year
- 4Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-19636
Insuffucient Protections Lead to Brute Force
Tenable, Inc. · Security Center
Medium6.0 - CVE-2026-15831
Generation of Incorrect Security Tokens in GitLab
GitLab · GitLab
Medium4.3 - CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
pterodactyl · panel
High8.1 - CVE-2026-49499
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged…
Dell · PowerProtect Data Manager
High8.8 - CVE-2025-59698
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), might allow a physically…
Product not named
Medium6.8 - CVE-2023-32188
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
SUSE · neuvector
Critical9.4 - CVE-2023-22644
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
SUSE · neuvector
Critical9.4 - CVE-2023-2882
Privilege Escalation in CBOT's Chatbot
CBOT · Chatbot
Critical9.8 - CVE-2023-30524
Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for…
Jenkins Project · Jenkins Report Portal Plugin
Medium4.3 - CVE-2022-31122
Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation
wireapp · wire-server
Critical9.8