CWE-807 · weakness in Input Validation and Logic
Reliance on Untrusted Inputs in a Security Decision
111 CVEs · 2 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 2
- check available
- 1
Every one of the 111 is a mark on the map. Named now: 1 to 26, most at risk first.
- Microsoft Office Security Feature Bypass Vulnerability
- Microsoft Word Security Feature Bypass Vulnerability
- 9router <=0.5.4 - Authentication Bypass
- A business logic vulnerability in the Up2Date component of Sophos Firewall older than version 21.0 MR1 (20.0.1) can lead to attackers controlling the firewall’s DNS environment to…
- Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) Vulnerable to Bypass of IAM Authenticator
- Kiteworks Core Remote Code Execution
- DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
- Rancher: Privilege escalation vulnerability via malicious Connection header
- Microsoft Exchange Server Elevation of Privilege Vulnerability
- Windows Kerberos Elevation of Privilege Vulnerability
- Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state
- Cisco Firepower Management Center Software Information Disclosure Vulnerability
- login-proxy sends password to attacker-provided domain
- Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an aut…
- Cached redirect poisoning via X-Forwarded-Host header
- Telenia TVox 26.5.3 Authentication Bypass via set_env.php
- Visual Studio Code Security Feature Bypass Vulnerability
- Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for sp…
- Windows IKE Extension Spoofing Vulnerability
- Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
- Microsoft PowerShell Remote Code Execution Vulnerability
- oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability
- oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability
- Microsoft PowerShell Remote Code Execution Vulnerability
- Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers
- authentik: Authentication Flow Bypass via Unguarded challenge_valid() in AuthenticatorEndpointGDTCStage and GoogleChromeStageView
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.