CWE-620

CVEs per yearBy the year they were published

1. 20171
2. 20181
3. 20201
4. 20213
5. 20224
6. 20239
7. 202412
8. 202536
9. 202642

Newest CVEs

• CVE-2025-71457

  vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

  vtenext · vtenext

  Critical9.3
• CVE-2026-119429

  phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

  phpMyAdmin · phpMyAdmin

  Medium5.3
• CVE-2026-118984

  OmniRoute 3.8.0 before 3.8.52 Unverified Password Change via /api/settings/require-login

  cheaper-inference · OmniRoute

  High7.0
• CVE-2013-20008

  Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

  Linksys · WAG200G

  High7.0
• CVE-2026-112002

  ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/password

  ProjectSend · ProjectSend

  High7.6
• CVE-2026-97380

  MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

  MariaDB · server

  High8.8
• CVE-2026-104106

  FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification

  error311 · FileRise

  Medium6.5
• CVE-2026-102603

  Gotify: Insufficiently Protected Password Change endpoint

  gotify · server

  Medium5.3
• CVE-2026-105785

  Joplin Server password reset accepts tokens issued for unrelated purposes

  laurent22 · joplin

  Medium4.8
• CVE-2026-92467

  microservices-platform through 6.0.0 Unverified Password Change via /users/password

  zlt2000 · microservices-platform

  High8.7

Vendors it comes up for most

1. scriptsbundle4
2. Cisco3
3. Fortinet3
4. Siemens3
5. octoprint3
6. Flowise2
7. IBM2
8. Johnson Controls2
9. Lantronix2
10. Laravel-Backpack2