CWE-915
208 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 208Published CVEs208 of them scored
- 175Last 12 monthspublished in the last year
- 34Critical98 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-95648
Privilege Escalation in C-Prot's C-Prot AppDefense
C-Prot Inc. · C-Prot AppDefense
High8.1 - CVE-2026-123526
Vikunja before 2.7.1 Mass Assignment via Team external_id Field
go-vikunja · vikunja
Medium5.3 - CVE-2026-17394
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.6 - CVE-2026-17117
Multiple Vulnerabilities in IBM API Connect
IBM · API Connect
Critical9.9 - CVE-2026-122053
Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
sensiolabs · symfony
Medium6.9 - CVE-2026-123490
Craft CMS before 5.11.2 Privilege Escalation via getOwners() Sandbox Bypass
craftcms · cms
High8.7 - CVE-2026-123294
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow
JetBrains · Hub
Critical9.6 - CVE-2026-100361
SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
SuiteCRM · SuiteCRM
High7.1 - CVE-2026-120448
DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
doramart · DoraCMS
High8.6 - CVE-2026-119565
Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update
Plausible · Plausible Analytics
Medium5.3