Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1385
Weakness type CWE-1385 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 16 | 16 | 0 |
Monthly trend
▂▅▂█▄
2026-06 1 · 2026-07 4 · 2026-08 1 · 2026-09 7 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-88061 | 5.8 | 29.9 | — | career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowi… |
| CVE-2026-57111 | 7.5 | 26.7 | — | Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-… |
| CVE-2026-59804 | 7.6 | 22.1 | — | Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket |
| CVE-2026-85183 | 9.3 | 13.3 | — | Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS |
| CVE-2026-59950 | 7.6 | 12.9 | — | MCP Python SDK: WebSocket server transport does not support Host/Origin validation |
| CVE-2026-10054 | 8.8 | 11.6 | — | — |
| CVE-2026-44211 | 9.6 | 10.1 | — | Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability |
| CVE-2026-54565 | 4.7 | 8.3 | — | rhwp browser extension performs SSRF / private-network requests and leaks HWP preview d… |
| CVE-2026-15580 | 6.9 | 8.0 | — | PassPortal browser extension: vault token disclosure via unvalidated postMessage |
| CVE-2026-71416 | 8.8 | 6.4 | — | Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH) |
| CVE-2026-104380 | 5.3 | 5.1 | — | Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET… |
| CVE-2026-77363 | 8.8 | 4.5 | — | obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access |
| CVE-2026-109330 | 5.3 | 4.2 | — | Network-AI 5.0.0 before 5.15.2 Cross-Site WebSocket Hijacking via DashboardServer |
| CVE-2026-13272 | 5.4 | 3.7 | — | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Secu… |
| CVE-2026-18251 | 4.3 | 3.0 | — | IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificat… |
| CVE-2026-67405 | 5.3 | 2.0 | — | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 2 |
| apache | 1 |
| avaiga | 1 |
| cline | 1 |
| eclipse foundation | 1 |
| edwardkim | 1 |
| headroomlabs-ai | 1 |
| jovancoding | 1 |
| modelcontextprotocol | 1 |
| n-able | 1 |
| rabbitmq | 1 |
| santifer | 1 |
| the-40-thieves | 1 |
| web-infra-dev | 1 |
