CWE-522

1,591 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 5 of them as exploited in the wild.

Critical 244High 558Medium 723Low 65Not scored 1

CVEs per yearBy the year they were published

CVE-2021-22681
Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are…
Rockwell Automation Studio 5000 Logix Designer, RSLogix 5000, Logix Controllers
ExploitedCritical9.8
CVE-2021-30116
Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
Product not named
ExploitedCritical10.0
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found…
Product not named
ExploitedCritical9.8
CVE-2017-9248
Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect…
Product not named
ExploitedCritical9.8
CVE-2014-1812
The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server…
Product not named
ExploitedHigh8.8

CVE-2026-17367
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Medium5.4
CVE-2026-123856
In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server
JetBrains · Toolbox App
Medium6.5
CVE-2026-66982
HCL AION is affected by multiple security vulnerabilities.
HCL Software · HCL AION
Low3.3
CVE-2026-119757
BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
BTCPay Server · BTCPay Server
Critical9.3
CVE-2026-123059
Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
Eclipse Foundation · Eclipse BaSyx Helm Charts
High7.5
CVE-2026-123047
Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts
Eclipse Foundation · Eclipse BaSyx Helm Charts
High7.5
CVE-2026-73116
Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects
Apache Software Foundation · Apache Juneau
Critical10.0
CVE-2026-54378
VitaFit Cloud API Broken Access Control via S3 Token Endpoint
Shenzhen Shine Industrial Co., Ltd. · VitaFit
Critical9.3
CVE-2026-97693
Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise
xerrors · Yuxi
Critical9.9
CVE-2026-113371
Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
Sonatype · Nexus Repository 3
High7.1