CWE-289
50 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 50Published CVEs50 of them scored
- 31Last 12 monthspublished in the last year
- 10Critical25 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126615
Authentication Bypass by Alternate Name in hMailServer
Progressive Robot Ltd · hMailServer
Medium5.3 - CVE-2026-100351
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
getkin · kin-openapi
High7.4 - CVE-2026-104143
DataEase: Stored SQL Injection via dateFormat field templates
dataease · dataease
High8.7 - CVE-2026-57176
social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend
python-social-auth · social-core
Medium6.8 - CVE-2026-95514
WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
netgsm · Netgsm
Medium5.3 - CVE-2026-76183
Apache Tomcat: Bypass of security constraints for WebSocket endpoints
Apache Software Foundation · Apache Tomcat
Critical9.8 - CVE-2026-73511
Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)
envoyproxy · envoy
Medium5.3 - CVE-2026-92579
AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision
WWBN · AVideo
Medium5.3 - CVE-2026-12101
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
IBM · Verify Identity Access
High8.1 - CVE-2026-15980
MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token
TangibleWP · MyHome Core
Critical9.8