Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-170
Weakness type CWE-170 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 19 | 16 | 0 |
Monthly trend
▅▁▁▁▁▁▁▁▁▁▁▁▁▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▅▅▆▅█▆
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 2 · 2026-07 3 · 2026-08 2 · 2026-09 4 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-36906 | 7.5 | 80.4 | — | Windows Cryptographic Services Information Disclosure Vulnerability |
| CVE-2023-36907 | 7.5 | 77.3 | — | Windows Cryptographic Services Information Disclosure Vulnerability |
| CVE-2024-43474 | 7.5 | 69.4 | — | Microsoft SQL Server Information Disclosure Vulnerability |
| CVE-2026-70587 | 7.5 | 63.0 | — | Windows Remote Desktop Protocol Information Disclosure Vulnerability |
| CVE-2026-42010 | 9.8 | 60.4 | — | Gnutls: gnutls: authentication bypass via nul character in username |
| CVE-2026-45798 | 7.5 | 59.5 | — | Wazuh: Pre-auth stack-buffer-overflow in compare_wazuh_versions reachable from wazuh-au… |
| CVE-2026-5067 | 9.8 | 58.0 | — | Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocke… |
| CVE-2026-55738 | 8.7 | 45.1 | — | Stack Buffer Overflow in rxi/microtar raw_to_header() via non-null-terminated TAR name … |
| CVE-2026-78506 | 5.5 | 44.4 | — | Microsoft Office Word Information Disclosure Vulnerability |
| CVE-2026-44452 | 5.9 | 34.1 | — | h2o is vulnerable to heap overrun |
| CVE-2026-96860 | 5.5 | 32.4 | — | Windows USB Print Driver Information Disclosure Vulnerability |
| CVE-2026-96850 | 5.5 | 31.3 | — | Windows Modern Device Management (MDM) Information Disclosure Vulnerability |
| CVE-2026-83781 | 7.8 | 23.3 | — | Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability |
| CVE-2026-73324 | 5.3 | 14.1 | — | VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability |
| CVE-2026-43028 | 7.1 | 6.5 | — | netfilter: x_tables: ensure names are nul-terminated |
| CVE-2026-72095 | 7.8 | 6.4 | — | dma-fence: Make dma_fence_dedup_array() robust against 0-count input |
| CVE-2026-63860 | 8.4 | 3.0 | — | RDMA/core: Prefer NLA_NUL_STRING |
| CVE-2026-12386 | 3.9 | 2.6 | — | Buffer Overflow in TUBITAK BILGEM's Pardus Pen |
| CVE-2026-81882 | 6.1 | 2.4 | — | radare2: Missing string termination causes heap out-of-bounds read in radare2 bplist pa… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 8 |
| linux | 3 |
| h2o | 1 |
| radareorg | 1 |
| red hat | 1 |
| rxi | 1 |
| tubitak bilgem software technologies research institute | 1 |
| videolan | 1 |
| wazuh | 1 |
| zephyrproject-rtos | 1 |
