CWE-636 · weakness in Misconfiguration and Insecure Design
Not Failing Securely
64 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- likely to be exploited
- 1
Every one of the 64 is a mark on the map. Named now: 1 to 26, most at risk first.
- Remote Registry Service Elevation of Privilege Vulnerability
- Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
- Command 'go get' may unexpectedly fallback to insecure git in cmd/go
- Windows BitLocker Information Disclosure Vulnerability
- Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access
- Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation
- Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
- Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package
- .NET Security Feature Bypass Vulnerability
- NGINX ngx_http_js_module vulnerability
- NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
- node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions
- OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI
- Visual Studio Code Security Feature Bypass Vulnerability
- Visual Studio Code Security Feature Bypass Vulnerability
- An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
- free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions
- Vault Vulnerable to Denial of Service When Processing Raft Join Requests
- Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
- The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-sa…
- Fallback to second RAUC slot with default credentials
- Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- MyBB: Security Question insufficient validation
- free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions
- Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails
- Moquette fails open when configured authentication or authorization classes cannot load
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.