misconfiguration vulnerabilities
misconfiguration in numbers
sbomify tracks 1,377 misconfiguration vulnerabilities. Most are found in server software (31%), operating system (23%) and network device (17%).
How to fix misconfiguration vulnerabilities
Most exploited misconfiguration vulnerabilities
- CVE-2022-20821 Cisco IOS XR Open Port
- CVE-2019-5591 Fortinet FortiOS Default Configuration
- CVE-2026-72421 ipv4: fib: Don't ignore error route in local/main tables.
- CVE-2025-12104 Incorrect Content-Type Header
- CVE-2022-42150 Misconfiguration in n/a
- CVE-2023-1968 CVE-2023-1968
- CVE-2022-4390 Misconfiguration in NETGEAR Nighthawk RAX30
- CVE-2020-12030 Emerson WirelessHART Gateway
- CVE-2020-29491 Misconfiguration in Wyse Proprietary OS (ThinOS)
- CVE-2020-29492 Misconfiguration in Wyse Proprietary OS (ThinOS)
- CVE-2020-10271 Misconfiguration in MiR100
- CVE-2018-0268 Misconfiguration in Cisco Digital Network Architecture Center
Recently published
- CVE-2026-108780 Apache Kylin: Potential JDBC source configuration validation issue
- CVE-2026-108833 Apache Kylin: default startup profile miss security settings
- CVE-2026-3303 IBM Concert Software Permissive Cross-domain Security Policy
- CVE-2026-111922 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
- CVE-2026-108372 LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
- CVE-2025-68403 Inadequate Steps to Confirm Vulnerability in QuRouter
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- Missing authorization28,513
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.