Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-172
Weakness type CWE-172 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 7 | 6 | 0 |
Monthly trend
▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▁▆█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 0 · 2026-06 0 · 2026-07 1 · 2026-08 0 · 2026-09 2 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2019-10160 | 9.8 | 92.4 | — | — |
| CVE-2026-106122 | 6.0 | 39.9 | — | RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers |
| CVE-2026-104774 | 5.8 | 32.7 | — | OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass |
| CVE-2026-48784 | 5.1 | 26.9 | — | Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Ge… |
| CVE-2026-100891 | 5.5 | 20.5 | — | Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opend… |
| CVE-2026-86818 | 4.8 | 15.6 | — | fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchro… |
| CVE-2026-95101 | 6.9 | 14.9 | — | NGINX ngx_http_v3_module vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| com.rabbitmq | 1 |
| corazawaf | 1 |
| f5 | 1 |
| fast-uri | 1 |
| python | 1 |
| rabbitmq | 1 |
| symfony | 1 |
| trusted domain project | 1 |
