CWE-636
79 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 79Published CVEs79 of them scored
- 66Last 12 monthspublished in the last year
- 14Critical29 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-109408
vault-java-driver: SslConfig silently disables requested TLS verification
jopenlibs · vault-java-driver
High7.4 - CVE-2026-102280
Sandboxie-Plus: Sandbox containment bypass
sandboxie-plus · Sandboxie
Medium6.9 - CVE-2026-95860
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
node-opcua · node-opcua
Critical9.1 - CVE-2026-109593
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing…
SonicWall · Global Management System (GMS)
Critical9.1 - CVE-2026-110985
Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Apache Software Foundation · Apache Kafka
Critical9.1 - CVE-2026-108142
A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
Veeam · Backup and Replication
Critical9.1 - CVE-2026-105933
Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
Apache Software Foundation · Apache Pulsar
Low2.3 - CVE-2026-114479
Not Failing Securely ('Failing Open') in hMailServer
Progressive Robot Ltd · hMailServer
Medium5.8 - CVE-2026-74048
Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Apache Software Foundation · Apache Tomcat
Medium6.5 - CVE-2026-103502
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
hexpm · hex_core
Medium5.9