Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-174
Weakness type CWE-174 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 5 | 5 | 0 |
Monthly trend
▅██
2026-08 1 · 2026-09 2 · 2026-10 2
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-109955 | 6.9 | 22.9 | — | Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding |
| CVE-2026-92839 | 4.3 | 19.1 | — | — |
| CVE-2026-93903 | 9.4 | 16.2 | — | — |
| CVE-2026-75899 | 7.5 | 11.8 | — | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding |
| CVE-2026-111757 | 5.3 | — | — | Hono: `serveStatic` decodes the request path a second time, leading to bypass of middle… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| honojs | 2 |
| canva | 1 |
| fast-uri | 1 |
| litespeedtech | 1 |
