Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-177
Weakness type CWE-177 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 9 | 8 | 1 |
Monthly trend
▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▆█▆▃
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 0 · 2026-06 0 · 2026-07 2 · 2026-08 3 · 2026-09 2 · 2026-10 1
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-76504 | 9.8 | 78.4 | KEV | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability |
| CVE-2022-27780 | 7.5 | 84.6 | — | — |
| CVE-2026-41041 | 9.1 | 47.5 | — | Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP RES… |
| CVE-2026-59083 | 9.1 | 29.3 | — | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass |
| CVE-2026-15371 | 8.1 | 29.1 | — | Velociraptor Stored XSS in URL column types |
| CVE-2026-100409 | 7.5 | 21.8 | — | OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths |
| CVE-2026-96748 | 8.3 | 16.2 | — | Connection redirection via percent-encoded delimiter injection in connection string hosts |
| CVE-2026-76172 | 7.5 | 13.1 | — | fast-uri vulnerable to host confusion via percent-encoded scheme normalization |
| CVE-2026-67448 | 6.5 | 11.7 | — | Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026… |
