Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1287
Weakness type CWE-1287 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 48 | 44 | 1 |
Monthly trend
▂▁▁▂▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▃▂▃▁▆▇▅▆█▅
2025-11 0 · 2025-12 0 · 2026-01 2 · 2026-02 1 · 2026-03 2 · 2026-04 0 · 2026-05 6 · 2026-06 8 · 2026-07 5 · 2026-08 6 · 2026-09 9 · 2026-10 5
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-4879 | 9.3 | 100.0 | KEV | Jelly Template Injection Vulnerability in ServiceNow UI Macros |
| CVE-2026-25639 | 7.5 | 80.3 | — | Axios affected by Denial of Service via __proto__ Key in mergeConfig |
| CVE-2026-5946 | 7.5 | 76.8 | — | Invalid handling of CLASS != IN |
| CVE-2026-59680 | 8.6 | 75.1 | — | yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attri… |
| CVE-2026-44249 | 8.1 | 69.8 | — | Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking |
| CVE-2026-50524 | 7.5 | 68.5 | — | .NET Framework Denial of Service Vulnerability |
| CVE-2026-4598 | 7.7 | 61.0 | — | — |
| CVE-2026-24307 | 9.3 | 59.2 | — | M365 Copilot Information Disclosure Vulnerability |
| CVE-2023-3904 | 4.3 | 54.4 | — | Improper Validation of Specified Type of Input in GitLab |
| CVE-2026-96044 | 8.8 | 53.4 | — | Microsoft Office SharePoint Elevation of Privilege Vulnerability |
| CVE-2026-86287 | 7.5 | 48.1 | — | Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths |
| CVE-2026-97801 | 7.5 | 48.1 | — | .NET Framework Tampering Vulnerability |
| CVE-2026-55124 | 5.5 | 47.4 | — | Microsoft Word Information Disclosure Vulnerability |
| CVE-2023-3906 | 3.5 | 45.8 | — | Improper Validation of Specified Type of Input in GitLab |
| CVE-2026-9521 | 2.9 | 44.2 | — | fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified ty… |
| CVE-2026-21932 | 7.4 | 43.3 | — | — |
| CVE-2026-9753 | 7.2 | 43.0 | — | Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. |
| CVE-2026-18830 | 8.6 | 41.9 | — | Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API |
| CVE-2026-9742 | 8.2 | 41.9 | — | Authenticate command with specific mechanism parameter can trigger server crash |
| CVE-2026-9390 | 9.1 | 41.8 | — | XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 5 |
| gitlab | 2 |
| mattermost | 2 |
| mongodb | 2 |
| red hat | 2 |
| suse | 2 |
| arista networks | 1 |
| ash-project | 1 |
| aws | 1 |
| axios | 1 |
| axis communications ab | 1 |
| boost | 1 |
| concrete cms | 1 |
| dell | 1 |
| eclipse foundation | 1 |
