CWE-552

548 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 6 of them as exploited in the wild.

Critical 55High 218Medium 265Low 10Not scored 0

CVEs per yearBy the year they were published

CVE-2026-21589
This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center.…
Atlassian · Bamboo Data Center
ExploitedCritical9.3
CVE-2025-11371
Gladinet CentreStack and TrioFox Local File Inclusion Flaw
Gladinet · CentreStack and TrioFox
ExploitedHigh7.5
CVE-2025-48928
The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent to a "core dump" in which a password…
TeleMessage · service
ExploitedMedium4.0
CVE-2020-17519
Apache Flink directory traversal attack: reading remote files through the REST API
Apache Software Foundation · Apache Flink
ExploitedCritical9.1
CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including…
Product not named
ExploitedHigh7.8
CVE-2016-3715
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Product not named
ExploitedMedium5.5

CVE-2026-123988
SililaWijesinghe Food Ordering System admin exposure of information through directory listing
SililaWijesinghe · Food Ordering System
Medium6.9
CVE-2026-119757
BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
BTCPay Server · BTCPay Server
Critical9.3
CVE-2026-65983
OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
openemr · openemr
High7.5
CVE-2026-123197
WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files
wppconnect · wppconnect-server
Medium6.9
CVE-2026-90632
Apache OpenOffice: Local file inclusion via GStreamer plugin
Apache Software Foundation · Apache OpenOffice
Medium5.5
CVE-2026-90627
Apache OpenOffice: Local file inclusion via SQL provider and flat file database references
Apache Software Foundation · Apache OpenOffice
Medium5.5
CVE-2026-120501
An Otter Wiki 2.20.1 before 2.26.2 Repository File Disclosure via DataTable src
redimp · otterwiki
Medium6.9
CVE-2026-84172
Apache Wicket: Component markup is served as a package resource when wicket-core has its own class loader
Apache Software Foundation · Apache Wicket
Medium6.3
CVE-2026-61730
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
socfortress · CoPilot
Critical9.3
CVE-2026-119201
Nuxt dev server exposes generated appSecret through Vite file serving
nuxt · nuxt
Medium4.8