Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1188
Weakness type CWE-1188 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 105 | 95 | 5 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▇▆▅██
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 7 · 2026-06 19 · 2026-07 16 · 2026-08 11 · 2026-09 21 · 2026-10 21
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-13927 | 9.8 | 100.0 | KEV | Apache Airflow's Experimental API |
| CVE-2023-27524 | 8.9 | 99.9 | KEV | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY |
| CVE-2022-24706 | 9.8 | 99.8 | KEV | Remote Code Execution Vulnerability in Packaging |
| CVE-2025-48927 | 5.3 | 95.9 | KEV | TeleMessage TM SGNL |
| CVE-2023-6448 | 9.8 | 81.3 | KEV | Unitronics VisiLogic uses a default administrative password |
| CVE-2026-66066 | 9.5 | 98.1 | — | Action Pack: Possible arbitrary file read and remote code execution in Active Storage v… |
| CVE-2018-8014 | 9.8 | 97.6 | — | — |
| CVE-2026-67208 | 9.3 | 91.0 | — | Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console |
| CVE-2026-47668 | 10.0 | 90.1 | — | DbGate: Unauthenticated Remote Code Execution via JSON Script Runner |
| CVE-2026-44825 | 9.8 | 86.4 | — | Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users |
| CVE-2026-54066 | 7.5 | 83.7 | — | SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary… |
| CVE-2026-52824 | 9.1 | 70.7 | — | Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover |
| CVE-2026-87827 | 10.0 | 64.5 | — | KGUARD DVR unauthenticated remote command execution vulnerability |
| CVE-2026-50519 | 7.5 | 59.6 | — | Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability |
| CVE-2026-57127 | 9.8 | 58.9 | — | praisonai: recipe serve auth middleware silently disables itself when no secret is set |
| CVE-2026-47393 | 9.8 | 55.1 | — | PraisonAI `deploy --type api` emits a Flask server with authentication disabled by default |
| CVE-2025-59321 | 9.8 | 54.9 | — | — |
| CVE-2026-77915 | 9.3 | 54.9 | — | rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php |
| CVE-2026-57147 | 9.8 | 54.8 | — | praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token for… |
| CVE-2026-57139 | 9.8 | 54.2 | — | PraisonAI MCPServer exposes unauthenticated HTTP tools/call |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 8 |
| mervinpraison | 6 |
| dell | 3 |
| 3 | |
| linux | 3 |
| siyuan-note | 3 |
| joomdonation.com | 2 |
| messagepack-csharp | 2 |
| obsidian | 2 |
| sap_se | 2 |
| sharp | 2 |
| splunk | 2 |
| vps.org | 2 |
| xyproto | 2 |
| alibaba | 1 |
