Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-1391
Weakness type CWE-1391 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 16 | 16 | 0 |
Monthly trend
▄▄▄▄█▅
2026-05 2 · 2026-06 2 · 2026-07 2 · 2026-08 2 · 2026-09 5 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-46623 | 7.4 | 51.0 | — | OpenAM Account Takeover via Unverified Password Change in OAuth2 Module |
| CVE-2026-35089 | 8.7 | 45.5 | — | Use of Weak Credentials in Slican telephone exchanges |
| CVE-2026-47325 | 6.9 | 35.0 | — | Weak password policy in ProjectsAndPrograms school-management-system |
| CVE-2026-109321 | 9.3 | 32.9 | — | Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass |
| CVE-2026-45363 | 9.1 | 28.7 | — | `jwt` (Ruby gem) - empty-key HMAC bypass |
| CVE-2026-79679 | 7.0 | 26.5 | — | Use of Weak Credentials |
| CVE-2026-107828 | 6.9 | 26.3 | — | Jivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth Login |
| CVE-2026-66409 | 6.9 | 24.0 | — | — |
| CVE-2026-22094 | 9.3 | 14.0 | — | Weak root password in EVbee DC 80 |
| CVE-2026-57473 | 5.8 | 12.7 | — | — |
| CVE-2026-66408 | 5.1 | 9.7 | — | — |
| CVE-2026-4377 | 6.0 | 9.1 | — | Use of Weak Credentials in D-Link DWR-X1820 router |
| CVE-2026-107153 | 7.0 | 8.6 | — | — |
| CVE-2026-49852 | 8.7 | 8.5 | — | joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of… |
| CVE-2026-88761 | 6.0 | 5.8 | — | Botslab G980H Dashcams Use of Weak Credentials |
| CVE-2026-100299 | 7.0 | 0.3 | — | Use of Weak Credentials in Anjvision YSSD-RTMP-H5 |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ecovacs robotics | 2 |
| anjvision | 1 |
| authlib | 1 |
| b&r industrial automation | 1 |
| banq | 1 |
| botslab | 1 |
| d-link | 1 |
| evbee | 1 |
| getgrav | 1 |
| jwt | 1 |
| openidentityplatform | 1 |
| projectsandprograms | 1 |
| rakuten mobile | 1 |
| reolink | 1 |
| slican | 1 |
