CWE-470

147 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 34High 75Medium 34Low 2Not scored 2

CVEs per yearBy the year they were published

CVE-2026-82078
PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector
PaperCut · PaperCut MF/NG
ExploitedCritical9.4
CVE-2021-21985
The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is…
VMware vCenter Server and VMware Cloud Foundation
ExploitedCritical9.8

CVE-2026-123544
OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP Channel
OpenIdentityPlatform · OpenAM
Medium6.1
CVE-2026-90436
Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName
Apache Software Foundation · Apache Axis 1.x (EOL)
Not scored
CVE-2026-82894
Apache OFBiz: Content renderer runs a service name stored on the row
Apache Software Foundation · Apache OFBiz
Not scored
CVE-2026-73098
Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing
Apache Software Foundation · Apache Juneau
Critical10.0
CVE-2026-119084
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
AWS · amazon-redshift-jdbc-driver
Critical9.2
CVE-2026-16306
CVE-2026-16306
INFINITT Healthcare · System Manager
Critical9.8
CVE-2026-119578
MONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()
Project-MONAI · MONAI
High8.5
CVE-2026-108097
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal · Drupal core
High8.1
CVE-2026-108099
Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218
Drupal · Entity List
High8.1
CVE-2026-119050
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
agno-agi · agno
Critical9.2