Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-184
Weakness type CWE-184 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 125 | 118 | 2 |
Monthly trend
▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▆▅▆█▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 7 · 2026-06 22 · 2026-07 17 · 2026-08 22 · 2026-09 32 · 2026-10 17
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-5217 | 9.2 | 99.9 | KEV | Incomplete Input Validation in GlideExpression Script |
| CVE-2026-49869 | 10.0 | 81.3 | KEV | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `Authenticat… |
| CVE-2017-7525 | 9.8 | 98.5 | — | — |
| CVE-2018-7489 | 9.8 | 97.4 | — | — |
| CVE-2017-15095 | 9.8 | 94.9 | — | — |
| CVE-2018-5968 | 8.1 | 94.3 | — | — |
| CVE-2024-30103 | 8.8 | 88.7 | — | Microsoft Outlook Remote Code Execution Vulnerability |
| CVE-2026-63108 | 7.7 | 77.7 | — | Roo Code 3.54.0 Command Injection via Parameter Expansion Parsing |
| CVE-2026-87911 | 9.0 | 77.3 | — | Read-only enforcement bypass enabling operating system command execution in the SQL val… |
| CVE-2026-54513 | 8.1 | 68.4 | — | jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allo… |
| CVE-2026-56315 | 9.3 | 66.3 | — | picklescan - Remote Code Execution via Unblocked Standard Library Modules |
| CVE-2026-54512 | 8.1 | 62.2 | — | jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows ar… |
| CVE-2025-71323 | 9.3 | 61.9 | — | picklescan - Remote Code Execution via Unblocked ctypes Module |
| CVE-2026-70470 | 9.5 | 61.3 | — | Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE |
| CVE-2026-41934 | 8.7 | 60.6 | — | Vvveb < 1.0.8.2 Authenticated RCE via Code Editor |
| CVE-2026-84218 | 8.1 | 60.5 | — | Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of … |
| CVE-2026-47392 | 9.9 | 58.5 | — | PraisonAI vulnerable to sandbox escape via `print.__self__` builtins module leak in `ex… |
| CVE-2026-65083 | 9.9 | 57.8 | — | — |
| CVE-2025-71320 | 9.3 | 56.5 | — | picklescan - Remote Code Execution via Incomplete Disallowed Inputs |
| CVE-2026-53836 | 8.7 | 56.4 | — | OpenClaw < 2026.5.12 - Allowlist Bypass via PowerShell Encoded-Command Aliases |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| openclaw | 13 |
| microsoft | 7 |
| picklescan | 6 |
| fasterxml | 4 |
| red hat | 4 |
| aws | 3 |
| flowiseai | 3 |
| ibm | 3 |
| roocodeinc | 3 |
| symfony | 3 |
| tryghost | 3 |
| flavorjones | 2 |
| jetbrains | 2 |
| mervinpraison | 2 |
| steveukx | 2 |
