CWE-441

CVEs per yearBy the year they were published

1. 20171
2. 20182
3. 20194
4. 20201
5. 20216
6. 20223
7. 20232
8. 20244
9. 202534
10. 2026180

Known exploitedNewest addition to KEV first

• CVE-2026-83548

  A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote…

  SonicWall · SMA1000

  ExploitedCritical10.0

Newest CVEs

• CVE-2026-124440

  Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass

  kyverno · kyverno

  Critical9.4
• CVE-2026-123515

  Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images

  go-vikunja · vikunja

  Medium5.1
• CVE-2026-16920

  Multiple Vulnerabilities in IBM API Connect

  IBM · API Connect

  Critical9.9
• CVE-2026-88983

  Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation

  kubeflow · pipelines

  Medium5.0
• CVE-2026-121198

  Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…

  Google · Chrome

  High8.8
• CVE-2026-121171

  Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…

  Google · Chrome

  High8.8
• CVE-2026-121108

  Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML…

  Google · Chrome

  High8.8
• CVE-2026-49906

  An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the…

  Google · Android

  High7.8
• CVE-2026-49903

  The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a…

  Google · Android

  Medium5.3
• CVE-2026-59028

  In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of…

  Google · Android

  High8.4

Vendors it comes up for most

1. Google103
2. Red Hat10
3. axios5
4. Microsoft4
5. OpenClaw3
6. SonicWall3
7. coder3
8. @backstage2
9. Apache Software Foundation2
10. AsyncHttpClient2