Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-197
Weakness type CWE-197 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 62 | 55 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▃▃███
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 5 · 2026-07 5 · 2026-08 15 · 2026-09 14 · 2026-10 14
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2022-42475 | 9.3 | 99.9 | KEV | Fortinet FortiOS |
| CVE-2025-6965 | 7.2 | 99.5 | — | Integer Truncation on SQLite |
| CVE-2024-37337 | 4.3 | 76.3 | — | Microsoft SQL Server Native Scoring Information Disclosure Vulnerability |
| CVE-2024-21352 | 8.8 | 75.8 | — | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-21391 | 8.8 | 75.8 | — | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| CVE-2024-43519 | 8.8 | 73.8 | — | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability |
| CVE-2026-78512 | 8.8 | 56.4 | — | Microsoft Office Word Remote Code Execution Vulnerability |
| CVE-2026-102225 | 8.8 | 55.7 | — | Windows Text Shaping Remote Code Execution Vulnerability |
| CVE-2026-42944 | 8.7 | 54.9 | — | Heap overflow with multiple NSID, COOKIE, PADDING EDNS options |
| CVE-2026-68880 | 8.0 | 54.7 | — | Windows Win32k Elevation of Privilege Vulnerability |
| CVE-2026-76151 | 4.6 | 51.0 | — | Out-of-bounds read (buffer over-read) vulnerability in HTTP Cache-Control response head… |
| CVE-2026-96280 | 7.5 | 50.8 | — | Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems |
| CVE-2026-96113 | 9.8 | 50.5 | — | Windows Domain Name Service Remote Code Execution Vulnerability |
| CVE-2024-21377 | 5.5 | 50.1 | — | Windows DNS Information Disclosure Vulnerability |
| CVE-2026-55142 | 5.5 | 47.4 | — | Microsoft Word Information Disclosure Vulnerability |
| CVE-2026-19667 | 7.5 | 45.9 | — | Remote assertion failure via 16-bit length truncation in `dns_ncache_add()` |
| CVE-2026-69512 | 8.8 | 45.3 | — | Windows Spaceport.sys Elevation of Privilege Vulnerability |
| CVE-2026-73523 | 8.7 | 44.8 | — | COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation |
| CVE-2026-6679 | 8.8 | 41.8 | — | DTLS 1.3 ACK serialization heap buffer overflow via integer truncation |
| CVE-2026-87529 | 9.6 | 41.7 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 40 |
| juniper networks | 2 |
| red hat | 2 |
| capstone-engine | 1 |
| chainguard-dev | 1 |
| covesa | 1 |
| fortinet | 1 |
| freertos | 1 |
| 1 | |
| isc | 1 |
| nezhahq | 1 |
| nlnet labs | 1 |
| nnn | 1 |
| oisf | 1 |
| qt | 1 |
