CWE-472
167 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 167
- Last 12 months
- 116
- Critical
- 15
- Known exploited
- 1
Critical 15High 84Medium 63Low 5Not scored 0
CVEs per yearBy the year they were published
- 20172
- 20191
- 20201
- 20217
- 20223
- 202411
- 202528
- 2026114
Known exploitedNewest addition to KEV first
- CVE-2025-35939
Craft CMS stores user-provided content in session files
Craft · CMS
ExploitedMedium6.9
Newest CVEs
- CVE-2026-115450
Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
MarcosCamara01 · Ecommerce Template
High7.1 - CVE-2026-16453
Mattermost SAML RelayState forgery allows unauthorized team membership
Mattermost · Mattermost
High7.1 - CVE-2026-111447
Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved. A user able to…
Wheels · Wheels
High8.1 - CVE-2026-77470
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
LycheeOrg · Lychee
High8.3 - CVE-2026-55384
InvoiceShelf trusts client-supplied document totals
InvoiceShelf · InvoiceShelf
Medium5.3 - CVE-2026-103671
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be…
EC-CUBE CO.,LTD. · AmazonPay V2 Plugin (4.0/4.1 series)
Medium5.3 - CVE-2026-103080
WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
VillaTheme · Salevo
Medium5.3 - CVE-2026-107636
pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
ph7software · ph7builder
High7.1 - CVE-2026-107363
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authenticated by the…
OpenStack · Zaqar
Medium6.1 - CVE-2026-105322
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form
Unknown · Magee Shortcodes
Medium5.3