CWE-367

CVEs per yearBy the year they were published

1. 20131
2. 20152
3. 20176
4. 20186
5. 201921
6. 202047
7. 202128
8. 202276
9. 2023102
10. 202493
11. 2025110
12. 2026460

Known exploitedNewest addition to KEV first

• CVE-2026-119977

  WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

  WordPress Foundation · WordPress

  ExploitedHigh8.1
• CVE-2015-3246

  libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local…

  Product not named

  ExploitedHigh7.4
• CVE-2025-38352

  posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

  Linux · Linux

  ExploitedHigh7.8
• CVE-2025-22224

  VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local…

  VMware · ESXi

  ExploitedCritical9.3
• CVE-2024-30088

  Windows Kernel Elevation of Privilege Vulnerability

  Microsoft · Windows 10 Version 1507

  ExploitedHigh7.0
• CVE-2022-48618

  The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with…

  Apple · tvOS

  ExploitedHigh7.0
• CVE-2023-35311

  Microsoft Outlook Security Feature Bypass Vulnerability

  Microsoft · Microsoft 365 Apps for Enterprise

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-63440

  2FAuth: Authenticated SSRF via DNS rebinding in the otpauth image= icon fetch (validate-then-fetch TOCTOU)

  Bubka · 2FAuth

  Medium5.9
• CVE-2026-123835

  In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

  JetBrains · Datalore

  Medium5.9
• CVE-2026-123486

  WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php

  WWBN · AVideo

  Medium6.0
• CVE-2026-112913

  filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

  tox-dev · filelock

  Low3.3
• CVE-2026-123207

  LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding

  LibreSpark · LibreTV

  Low2.3
• CVE-2026-112110

  Privileged file deletion in SafeNet Authentication Client SACSrv

  Thalesgroup · Safenet Authentication Client Service

  Medium5.8
• CVE-2026-119345

  Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

  ultravioletrs · cocos

  High7.2
• CVE-2026-123119

  Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)

  sensiolabs · symfony

  Low2.3
• CVE-2026-122321

  Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass

  kyverno · kyverno

  High8.5
• CVE-2026-109518

  APT RCE via hard link reuse

  Debian · APT

  High7.7

Vendors it comes up for most

1. Microsoft98
2. Google58
3. Qualcomm, Inc.49
4. Linux42
5. OpenClaw25
6. HP Inc.16
7. IBM16
8. Dell15
9. MediaTek, Inc.15
10. Apache Software Foundation13