CWE-178

144 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 19High 70Medium 41Low 14Not scored 0

CVEs per yearBy the year they were published

CVE-2020-12812
An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully…
Fortinet FortiOS
ExploitedHigh7.5

CVE-2026-17409
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.4
CVE-2026-17085
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium4.1
CVE-2026-85287
HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
sysadminsmedia · homebox
Medium6.5
CVE-2026-73856
ModSecurity: Response Body Inspection Bypass
owasp-modsecurity · ModSecurity
High8.6
CVE-2026-123012
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different…
Gogs · Gogs
High7.1
CVE-2026-63121
Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules
kubewarden · policies
Medium6.3
CVE-2026-109411
Samba: access control bypass via vfs_ceph_rgw case-insensitive open
Samba · Samba
High8.1
CVE-2026-116135
HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
HTTP-Body
Critical9.8
CVE-2026-108313
Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.
Tanium · Tanium Server
Medium6.6
CVE-2026-105608
Consul vulnerable to an authorization bypass in service mesh registration
HashiCorp · Consul
High8.8