CWE-697
193 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 193
- Last 12 months
- 55
- Critical
- 21
- Known exploited
- 2
Critical 21High 71Medium 93Low 8Not scored 0
CVEs per yearBy the year they were published
- 20051
- 20111
- 20171
- 20181
- 202015
- 202125
- 202222
- 202341
- 202421
- 202510
- 202655
Known exploitedNewest addition to KEV first
- CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
ServiceNow · Now Platform
ExploitedCritical9.2 - CVE-2020-5849
Unraid 6.8.0 allows authentication bypass.
Product not named
ExploitedHigh7.5
Newest CVEs
- CVE-2026-115732
Certificate Name Authorization Bypass
Perforce · Puppet Enterprise
Critical9.0 - CVE-2026-104198
ZoneMinder failed token handling bypasses web authentication
ZoneMinder · zoneminder
Medium5.3 - CVE-2026-108969
itsmeravitejak Online-Examination-System Session session.php checkLogin comparison
itsmeravitejak · Online-Examination-System
Medium6.9 - CVE-2026-106252
Incorrect comparison in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a…
Google · Chrome
High8.8 - CVE-2026-71892
CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys
Legion of the Bouncy Castle Inc. · BC-JAVA
Medium6.9 - CVE-2026-102715
mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet
Eclipse Foundation · Eclipse ThreadX NetX Duo
High7.1 - CVE-2026-101913
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
beaugunderson · ip-address
Medium6.3 - CVE-2026-101912
ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range
beaugunderson · ip-address
Medium6.3 - CVE-2026-85292
InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)
InvoicePlane · InvoicePlane
Medium4.8 - CVE-2026-79913
Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses
cloudreve · cloudreve
Medium6.5