Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-129
Weakness type CWE-129 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 192 | 120 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▄▃▂▂▂▂▁▂▁▂▁▁▁▁▂▁▂▁▁▁▂▁▂▂▂▃█▄█▅
2025-11 0 · 2025-12 0 · 2026-01 3 · 2026-02 0 · 2026-03 3 · 2026-04 3 · 2026-05 6 · 2026-06 10 · 2026-07 32 · 2026-08 14 · 2026-09 31 · 2026-10 18
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2022-48503 | 8.8 | 88.0 | KEV | Apple Multiple Products |
| CVE-2022-35737 | 7.5 | 97.8 | — | — |
| CVE-2021-38654 | 7.8 | 93.6 | — | Microsoft Office Visio Remote Code Execution Vulnerability |
| CVE-2026-21413 | 9.8 | 71.7 | — | — |
| CVE-2023-2008 | 8.2 | 62.5 | — | Kernel: udmabuf: improper validation of array index leading to local privilege escalation |
| CVE-2026-32285 | 7.5 | 61.3 | — | Denial of service in github.com/buger/jsonparser |
| CVE-2026-91101 | 5.1 | 61.0 | — | HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities |
| CVE-2026-22859 | 5.6 | 58.6 | — | FreeRDP has a heap-buffer-overflow in urb_select_configuration |
| CVE-2026-3083 | 8.8 | 56.5 | — | GStreamer rtpqdm2depay Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2024-38587 | 7.8 | 55.3 | — | speakup: Fix sizeof() vs ARRAY_SIZE() bug |
| CVE-2026-55209 | 9.8 | 55.1 | — | resdata insufficiently validates untrusted GRDECL files |
| CVE-2026-45799 | 7.5 | 53.3 | — | Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wir… |
| CVE-2026-15685 | 7.5 | 52.8 | — | Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability |
| CVE-2026-65652 | 8.7 | 52.6 | — | temporalio/tchannel-go malformed checksum type causes process termination |
| CVE-2026-65653 | 8.7 | 52.6 | — | temporalio/tchannel-go zero-chunk call fragment causes process termination |
| CVE-2026-92152 | 9.3 | 51.0 | — | F´: Unvalidated Port Index in GenericHub |
| CVE-2026-32286 | 7.5 | 50.1 | — | Denial of service in github.com/jackc/pgproto3/v2 |
| CVE-2026-56111 | 8.3 | 50.0 | — | Marlin Firmware 2.1.2.7 Out-of-Bounds Write via M421 G-code Handler |
| CVE-2026-84445 | 8.7 | 49.7 | — | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` heade… |
| CVE-2025-21692 | 7.8 | 48.6 | — | net: sched: fix ets qdisc OOB Indexing |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| linux | 90 |
| geovision | 11 |
| qax-os | 6 |
| nvidia | 5 |
| vllm-project | 5 |
| freerdp | 3 |
| ibm | 3 |
| temporal technologies | 3 |
| academysoftwarefoundation | 2 |
| apache | 2 |
| eugeny | 2 |
| imagemagick | 2 |
| moby | 2 |
| red hat | 2 |
| samsung open source | 2 |
