CWE-349
55 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 55Published CVEs54 of them scored
- 27Last 12 monthspublished in the last year
- 6Critical20 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-123583
Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responses
hickory-dns · hickory-dns
Medium6.3 - CVE-2026-123653
esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input
esengine · DeepSeek-Reasonix
Medium5.3 - CVE-2026-59263
Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.
Apache Software Foundation · Apache OpenOffice
Low1.9 - CVE-2026-117656
Unverified Sign in with Apple callback parameter can override verified ID token claims
pow-auth · assent
Critical9.3 - CVE-2026-112256
Logon bypass (trust of attacker-controlled completed-methods list)
OpenText · Advanced Authentication Server
Critical9.2 - CVE-2026-102527
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes
nuxt-modules · og-image
Medium6.9 - CVE-2026-100755
Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab
GitLab · GitLab
Medium4.6 - CVE-2026-48100
Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
polybase · payy
High8.7 - CVE-2026-95985
Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
Amazon · Kiro IDE
High8.6 - CVE-2026-62364
wlc may disclose API tokens to project-configured URLs
WeblateOrg · wlc
Low2.3