Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-184

251 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 251 in the listAtom feed of new CVEsWhat CWE-184 is, at MITRE (opens in a new tab)
Published CVEs
251
Last 12 months
194
Critical
39
Known exploited
2

Critical 39High 114Medium 77Low 21Not scored 0

CVEs per yearBy the year they were published

  1. 20174
  2. 20188
  3. 20191
  4. 20202
  5. 20217
  6. 20225
  7. 20239
  8. 202411
  9. 202514
  10. 2026190

Known exploitedNewest addition to KEV first

  • CVE-2026-49869

    Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter`

    kestra-io · kestra

    ExploitedCritical10.0
  • CVE-2024-5217

    Incomplete Input Validation in GlideExpression Script

    ServiceNow · Now Platform

    ExploitedCritical9.2

Newest CVEs

  • CVE-2026-17150

    Multiple Vulnerabilities in IBM API Connect

    IBM · API Connect

    Critical9.9
  • CVE-2026-69128

    Chartbrew: AI orchestrator run_query SQL blocklist bypass enables arbitrary file read on connected PostgreSQL (quoted-identifier + pg_stat_file/pg_ls_* sibling gap)

    chartbrew · chartbrew

    Medium4.6
  • CVE-2026-123876

    Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

    Red Hat · Red Hat Enterprise Linux 10

    Medium4.4
  • CVE-2026-123783

    Skyvern through 1.0.56 Script Sandbox Bypass via types.CodeType Bytecode

    Skyvern-AI · skyvern

    High8.7
  • CVE-2026-113663

    AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

    ag2ai · ag2

    High8.8
  • CVE-2026-121949

    Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

    sensiolabs · symfony

    Low2.3
  • CVE-2026-118517

    Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)

    sensiolabs · symfony

    Low2.3
  • CVE-2026-123125

    Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass

    sensiolabs · symfony

    Medium6.3
  • CVE-2026-119567

    vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases

    vsftpd · vsftpd

    Low2.3
  • CVE-2026-96196

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft · Microsoft Edge (Chromium-based)

    High8.8

Vendors it comes up for most

  1. OpenClaw34
  2. Microsoft9
  3. Picklescan7
  4. trailofbits7
  5. Cisco5
  6. Red Hat5
  7. FasterXML4
  8. FlowiseAI4
  9. IBM4
  10. JetBrains4