CWE-354

CVEs per yearBy the year they were published

1. 20176
2. 20185
3. 201910
4. 202020
5. 202112
6. 202221
7. 202325
8. 202424
9. 202517
10. 202681

Newest CVEs

• CVE-2026-123317

  In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

  JetBrains · Ktor

  High8.1
• CVE-2026-120423

  undici vulnerable to Subresource Integrity bypass via whitespace in integrity metadata

  undici · undici

  Medium5.9
• CVE-2026-107846

  bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

  bitcoinjs · bitcoinjs-lib

  Critical9.3
• CVE-2026-119186

  Forge: AES-GCM authentication bypass via unvalidated tagLength option

  digitalbazaar · forge

  Medium5.9
• CVE-2026-118782

  Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

  digitalbazaar · forge

  High7.5
• CVE-2026-118776

  Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

  digitalbazaar · forge

  Low3.7
• CVE-2026-90720

  Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions…

  Dell · PowerProtect Data Domain

  Medium6.7
• CVE-2026-116608

  DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity check

  DAMO Academy · VideoLLaMA2

  Medium5.3
• CVE-2026-65625

  Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

  potatosalad · jose

  Medium5.9
• CVE-2026-115906

  zip: AES Entry HMAC Authentication Bypass on Premature EOF

  zip-rs · zip2

  Medium6.5

Vendors it comes up for most

1. Legion of the Bouncy Castle Inc.11
2. Samsung Mobile6
3. Huawei4
4. OpenSSL4
5. Zscaler4
6. Apache Software Foundation3
7. Microsoft3
8. cryptomator3
9. digitalbazaar3
10. wolfSSL3