Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-116
Weakness type CWE-116 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 158 | 150 | 4 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▁▂▇▅██▄
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 3 · 2026-03 3 · 2026-04 0 · 2026-05 5 · 2026-06 30 · 2026-07 22 · 2026-08 36 · 2026-09 34 · 2026-10 17
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-38475 | 9.1 | 100.0 | KEV | Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches f… |
| CVE-2022-24682 | 6.1 | 98.2 | KEV | Synacor Zimbra Collaborate Suite (ZCS) |
| CVE-2026-20245 | 7.8 | 97.9 | KEV | Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability |
| CVE-2022-42948 | 9.8 | 85.7 | KEV | Fortra Cobalt Strike |
| CVE-2021-30640 | 6.5 | 95.5 | — | Auth weakness in JNDIRealm |
| CVE-2022-25235 | 9.8 | 92.1 | — | — |
| CVE-2019-6109 | 6.8 | 89.9 | — | — |
| CVE-2026-56379 | 9.2 | 76.0 | — | ImageMagick - Command Injection via SVG Decoder |
| CVE-2026-48358 | 9.1 | 67.8 | — | Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) |
| CVE-2026-94545 | 5.3 | 63.3 | — | Satori-generated SVG has improper escaping |
| CVE-2026-25755 | 8.8 | 59.5 | — | jsPDF has PDF Object Injection via Unsanitized Input in addJS Method |
| CVE-2026-105244 | 5.3 | 56.6 | — | Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content |
| CVE-2026-49844 | 6.3 | 56.2 | — | Apache Log4j API: Improper serialization of non-finite floating-point values in MapMess… |
| CVE-2026-62184 | 8.7 | 55.2 | — | luci-app-banip Log Monitor IP Extraction Bypass |
| CVE-2026-54182 | 8.1 | 55.1 | — | backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled H… |
| CVE-2026-73417 | 8.6 | 54.0 | — | JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) |
| CVE-2026-54699 | 7.7 | 53.7 | — | Warp: OS command injection when opening terminal links from WSL |
| CVE-2026-50659 | 6.5 | 53.6 | — | .NET Spoofing Vulnerability |
| CVE-2026-25940 | 8.1 | 52.9 | — | jsPDF's PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioBu… |
| CVE-2026-107823 | 7.2 | 52.7 | — | MariaDB: privilege escalation via incorrect view frm parsing |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 8 |
| orval-labs | 7 |
| misp | 6 |
| duck-organization | 5 |
| parallax | 4 |
| microsoft | 3 |
| pgadmin.org | 3 |
| adobe | 2 |
| angular | 2 |
| ash-project | 2 |
| dell | 2 |
| ericcornelissen | 2 |
| glpi-project | 2 |
| 2 | |
| handlebars-lang | 2 |
