Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1289
Weakness type CWE-1289 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 27 | 27 | 1 |
Monthly trend
▃▃▄▃▂█▅
2026-04 2 · 2026-05 3 · 2026-06 4 · 2026-07 3 · 2026-08 1 · 2026-09 9 · 2026-10 5
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-48710 | 6.5 | 94.1 | KEV | Starlette has missing Host header validation that poisons request.url.path, bypassing p… |
| CVE-2026-47729 | 6.5 | 73.9 | — | Squid: Memory disclosure in FTP gateway |
| CVE-2025-62718 | 6.3 | 66.7 | — | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF |
| CVE-2026-39821 | 9.6 | 51.9 | — | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| CVE-2026-89049 | 8.5 | 50.7 | — | Server-side request forgery in the Session Manager port forwarding functionality in AWS… |
| CVE-2026-86831 | 8.7 | 49.8 | — | Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS |
| CVE-2026-74994 | 6.0 | 49.3 | — | inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth |
| CVE-2026-60074 | 7.5 | 49.1 | — | Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal… |
| CVE-2026-46644 | 6.9 | 44.1 | — | symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-o… |
| CVE-2026-88255 | 6.3 | 43.2 | — | mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encod… |
| CVE-2026-49942 | 7.3 | 40.7 | — | Net::CIDR::Set versions through 0.20 for Perl did not validate network masks |
| CVE-2026-106445 | 9.2 | 33.9 | — | Handlebars: JavaScript Injection via Own Property Check Bypass |
| CVE-2026-76977 | 4.3 | 29.5 | — | Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) |
| CVE-2026-50090 | 6.1 | 29.1 | — | Aqara OAuth redirect_uri validation bypass |
| CVE-2026-107288 | 3.7 | 29.2 | — | Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normaliz… |
| CVE-2026-100255 | 9.8 | 27.1 | — | — |
| CVE-2026-33810 | 8.2 | 25.9 | — | Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509 |
| CVE-2026-107289 | 6.8 | 23.7 | — | Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete … |
| CVE-2026-47674 | 5.3 | 22.3 | — | Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 |
| CVE-2026-97196 | 9.1 | 20.9 | — | WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| aws | 2 |
| go standard library | 2 |
| pydantic | 2 |
| rrwo | 2 |
| aqara | 1 |
| axios | 1 |
| edgelesssys | 1 |
| erlang | 1 |
| fedify-dev | 1 |
| golang.org/x/net | 1 |
| handlebars-lang | 1 |
| honojs | 1 |
| jetbrains | 1 |
| kludex | 1 |
| liquid web / stellarwp | 1 |
