Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1390
Weakness type CWE-1390 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 43 | 39 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▃▂▃▃▄█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 4 · 2026-06 2 · 2026-07 5 · 2026-08 5 · 2026-09 7 · 2026-10 16
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-55040 | 9.1 | 99.4 | KEV | Microsoft SharePoint Server Security Feature Bypass Vulnerability |
| CVE-2025-27740 | 8.8 | 89.0 | — | Active Directory Certificate Services Elevation of Privilege Vulnerability |
| CVE-2024-38239 | 7.2 | 77.5 | — | Windows Kerberos Elevation of Privilege Vulnerability |
| CVE-2025-26635 | 6.5 | 73.8 | — | Windows Hello Security Feature Bypass Vulnerability |
| CVE-2026-65098 | 9.8 | 61.8 | — | — |
| CVE-2024-35248 | 7.3 | 60.6 | — | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability |
| CVE-2026-73025 | 9.8 | 59.0 | — | Windows iSCSI Security Feature Bypass Vulnerability |
| CVE-2026-62895 | 8.8 | 56.3 | — | Azure Arc SQL Server Extension Elevation of Privilege Vulnerability |
| CVE-2026-77483 | 8.8 | 55.0 | — | SQL Server Elevation of Privilege Vulnerability |
| CVE-2026-83674 | 8.1 | 49.8 | — | Active Directory Federation Services (AD FS) Spoofing Vulnerability |
| CVE-2026-6274 | 9.8 | 49.8 | — | Authentication Bypass in DTS Electronics' Redline WR3200 |
| CVE-2026-83511 | 7.4 | 47.0 | — | Active Directory Federation Services (AD FS) Spoofing Vulnerability |
| CVE-2026-69982 | 5.9 | 45.8 | — | Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability |
| CVE-2026-70005 | 5.9 | 45.8 | — | Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability |
| CVE-2026-44476 | 6.3 | 45.7 | — | Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients w… |
| CVE-2026-85922 | 7.4 | 44.0 | — | Azure Key Vault Security Feature Bypass Vulnerability |
| CVE-2026-73819 | 9.3 | 43.5 | — | Ebyte NA111-M Weak Authentication |
| CVE-2026-69802 | 8.1 | 43.0 | — | Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability |
| CVE-2026-68067 | 9.3 | 42.4 | — | Mira Hormone Monitor, Mira Android App Weak Authentication |
| CVE-2026-50756 | 7.5 | 41.9 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 26 |
| indian motorcycle | 2 |
| berriai | 1 |
| doorkeeper-gem | 1 |
| dts electronics industry and trade ltd. co | 1 |
| ebyte | 1 |
| freepbx | 1 |
| gitroomhq | 1 |
| nvidia | 1 |
| palo alto networks | 1 |
| quanovate tech inc. (operating as mira / mira care) | 1 |
| rockwell automation | 1 |
| villatheme | 1 |
| ziina | 1 |
