Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-130
Weakness type CWE-130 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 51 | 46 | 1 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▂▁▁▁▃▄▃▄▅▅█
2025-11 0 · 2025-12 1 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 4 · 2026-05 5 · 2026-06 3 · 2026-07 6 · 2026-08 7 · 2026-09 7 · 2026-10 14
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-14847 | 8.7 | 99.7 | KEV | Zlib compressed protocol header length confusion may allow memory read |
| CVE-2021-36090 | 7.5 | 96.3 | — | Apache Commons Compress 1.0 to 1.20 denial of service vulnerability |
| CVE-2021-35517 | 7.5 | 95.7 | — | Apache Commons Compress 1.1 to 1.20 denial of service vulnerability |
| CVE-2019-3862 | 9.1 | 94.7 | — | — |
| CVE-2026-109390 | 9.8 | 75.5 | — | — |
| CVE-2026-33846 | 7.5 | 65.7 | — | Gnutls: gnutls: denial of service via heap buffer overflow in dtls handshake fragment r… |
| CVE-2026-5367 | 8.6 | 58.3 | — | Ovn: ovn: information disclosure via crafted dhcpv6 packets |
| CVE-2026-90678 | 7.5 | 54.8 | — | — |
| CVE-2026-31635 | 7.5 | 49.1 | — | rxrpc: fix oversized RESPONSE authenticator length check |
| CVE-2026-58096 | 8.8 | 47.8 | — | ppp(8): missing length validation in LcpDecodeConfig() |
| CVE-2026-6432 | 5.3 | 47.6 | — | Improper bounds validation in EmberZNet SDK |
| CVE-2026-33555 | 5.8 | 46.4 | — | — |
| CVE-2026-14587 | 5.5 | 44.4 | — | Unathenticated connection can hold Bolt channel open |
| CVE-2026-48685 | 6.5 | 44.0 | — | — |
| CVE-2026-77619 | 8.7 | 43.2 | — | Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory… |
| CVE-2026-9054 | 9.2 | 41.9 | — | Invalid IP packets cause a kernel panic |
| CVE-2026-73455 | 8.9 | 41.2 | — | Security Advisory 0173 |
| CVE-2026-41035 | 7.8 | 41.0 | — | — |
| CVE-2026-67292 | 9.3 | 39.9 | — | FreeRDP before 3.29.0 WebSocket Ping Buffer Over-disclosure |
| CVE-2026-26081 | 4.8 | 39.7 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 7 |
| juniper networks | 5 |
| haproxy | 3 |
| silicon labs | 3 |
| freebsd | 2 |
| linux | 2 |
| red hat | 2 |
| xen | 2 |
| 9front | 1 |
| abb | 1 |
| anydesk | 1 |
| arista networks | 1 |
| dragonflybsd | 1 |
| envoyproxy | 1 |
| faye | 1 |
