CWE-358

140 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 16High 45Medium 63Low 16Not scored 0

CVEs per yearBy the year they were published

CVE-2024-7965
Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8

CVE-2026-123600
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypass
hickory-dns · hickory-dns
Medium6.3
CVE-2026-123579
Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansion
hickory-dns · hickory-dns
Medium6.3
CVE-2026-123542
OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization Flow
OpenIdentityPlatform · OpenAM
High7.6
CVE-2026-108178
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium4.2
CVE-2026-96303
Microsoft PowerShell Security Feature Bypass Vulnerability
Microsoft · PowerShell 7.4
Medium6.5
CVE-2026-70174
.NET Remote Code Execution Vulnerability
Microsoft · .NET 10.0 runtime
High8.8
CVE-2026-85805
Microsoft PowerShell Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-96760
Authlib library contains a signature‑verification bypass vulnerability
Authlib · Authlib
Critical9.8
CVE-2026-46582
A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path
NLnet Labs · Unbound
Low3.7
CVE-2026-65058
Trezor Safe improper security check in on-device display
Trezor · Safe 3
Medium5.9