Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

CWE-290

851 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 7 of them as exploited in the wild.

All 851 in the listAtom feed of new CVEsWhat CWE-290 is, at MITRE (opens in a new tab)
Published CVEs
851
Last 12 months
401
Critical
163
Known exploited
7

Critical 163High 277Medium 382Low 29Not scored 0

CVEs per yearBy the year they were published

  1. 19991
  2. 20091
  3. 20178
  4. 201812
  5. 201925
  6. 202030
  7. 202147
  8. 202248
  9. 202359
  10. 2024127
  11. 2025115
  12. 2026378

Known exploitedNewest addition to KEV first

  • CVE-2026-102764

    Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support

    BeyondTrust · Remote Support

    ExploitedCritical9.3
  • CVE-2026-104935

    Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…

    Ivanti · Connect Secure

    ExploitedHigh8.6
  • CVE-2023-50224

    TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

    TP-Link · TL-WR841N

    ExploitedMedium6.5
  • CVE-2024-54085

    Redfish Authentication Bypass

    AMI · MegaRAC-SPx

    ExploitedCritical10.0
  • CVE-2024-4358

    Registration Authentication Bypass Vulnerability

    Progress Software Corporation · Telerik Report Server

    ExploitedCritical9.8
  • CVE-2022-24112

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    Apache Software Foundation · Apache APISIX

    ExploitedCritical9.8
  • CVE-2022-23131

    Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML

    Zabbix · Frontend

    ExploitedCritical9.1

Newest CVEs

  • CVE-2026-123587

    Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEC

    hickory-dns · hickory-dns

    High8.9
  • CVE-2026-123580

    Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3

    hickory-dns · hickory-dns

    High8.7
  • CVE-2026-123578

    Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0

    hickory-dns · hickory-dns

    Medium6.3
  • CVE-2026-123550

    OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions

    OpenIdentityPlatform · OpenAM

    Critical9.3
  • CVE-2026-19121

    Multiple Vulnerabilities in IBM API Connect

    IBM · API Connect

    High8.3
  • CVE-2026-18838

    Multiple Vulnerabilities in IBM API Connect

    IBM · API Connect

    Critical9.4
  • CVE-2026-17290

    Multiple Vulnerabilities in IBM API Connect

    IBM · API Connect

    High8.5
  • CVE-2026-17278

    Multiple Vulnerabilities in IBM API Connect

    IBM · API Connect

    Critical9.8
  • CVE-2026-17172

    Multiple Vulnerabilities in IBM API Connect

    IBM · API Connect

    High8.5
  • CVE-2026-116790

    FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY

    signalwire · freeswitch

    Critical9.1

Vendors it comes up for most

  1. Microsoft56
  2. Google33
  3. Mozilla30
  4. Apple19
  5. Apache Software Foundation16
  6. Huawei16
  7. OpenClaw16
  8. IBM14
  9. Dell11
  10. Red Hat11