Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-176
Weakness type CWE-176 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 16 | 15 | 1 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁█▂▂▇▅
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 0 · 2026-06 5 · 2026-07 1 · 2026-08 1 · 2026-09 4 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-43093 | 7.3 | 52.6 | KEV | Android Framework |
| CVE-2026-48618 | 6.5 | 88.1 | — | — |
| CVE-2026-105241 | 5.3 | 56.6 | — | Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch |
| CVE-2026-45062 | 8.1 | 54.2 | — | FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP F… |
| CVE-2026-45135 | 8.1 | 51.3 | — | Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files |
| CVE-2025-71316 | 9.2 | 33.5 | — | SQLite sqldiff remote code execution via argument injection |
| CVE-2026-59890 | 6.1 | 33.3 | — | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (… |
| CVE-2026-93990 | 8.7 | 33.0 | — | Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate |
| CVE-2026-93751 | 6.9 | 32.7 | — | uri-js through 4.4.1 Improper UTF-8 Decoding via pctDecChars |
| CVE-2026-89074 | 7.5 | 32.5 | — | MOVEit Transfer Email MFA Bypass |
| CVE-2026-86105 | 6.0 | 22.1 | — | Fireware OS Improper Authorization in Access Portal Reverse Proxy |
| CVE-2026-23950 | 5.9 | 17.1 | — | node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on mac… |
| CVE-2026-19954 | 5.4 | 11.3 | — | Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that q… |
| CVE-2026-49401 | 8.4 | 8.8 | — | Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) |
| CVE-2026-81869 | 5.1 | 7.1 | — | OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation |
| CVE-2026-14978 | 5.5 | 3.1 | — | Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended f… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 1 |
| caddyserver | 1 |
| denoland | 1 |
| garycourt | 1 |
| 1 | |
| hashicorp | 1 |
| isaacs | 1 |
| libexpat | 1 |
| nodejs | 1 |
| open-telemetry | 1 |
| php | 1 |
| progress | 1 |
| pypa | 1 |
| sqlite | 1 |
| watchguard | 1 |
