Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-204
Weakness type CWE-204 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 53 | 53 | 0 |
Monthly trend
▂▁▁▁▃▃▆█▇▇
2026-01 1 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 3 · 2026-06 3 · 2026-07 9 · 2026-08 13 · 2026-09 12 · 2026-10 12
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-69519 | 8.6 | 63.0 | — | Azure Stack HCI Information Disclosure Vulnerability |
| CVE-2026-66002 | 6.9 | 56.5 | — | Frappe: User Enumeration via PDDR |
| CVE-2026-54739 | 6.9 | 47.1 | — | Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential |
| CVE-2026-60007 | 9.1 | 45.0 | — | — |
| CVE-2026-110310 | 6.0 | 42.1 | — | RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 En… |
| CVE-2026-19965 | 2.9 | 41.0 | — | automad Password Reset Endpoint UserController.php requestPasswordResetToken response d… |
| CVE-2026-81033 | 6.9 | 40.3 | — | Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy |
| CVE-2026-54445 | 6.9 | 40.0 | — | Vantage6: Set admin user and password from environment or configuration |
| CVE-2026-84307 | 3.7 | 38.4 | — | Filament: Password validity disclosure for accounts denied panel access on login page |
| CVE-2026-54768 | 6.9 | 37.2 | — | WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user … |
| CVE-2026-73306 | 5.3 | 36.6 | — | Budibase: Account Enumeration via Login Lockout Response Differential |
| CVE-2026-61503 | 6.9 | 36.5 | — | Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences |
| CVE-2026-89173 | 6.9 | 36.5 | — | Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure |
| CVE-2018-25350 | 9.3 | 36.2 | — | userSpice 4.3.24 Username Enumeration via existingUsernameCheck.php |
| CVE-2026-27462 | 7.5 | 36.1 | — | Combodo iTop: User enumeration via password reset |
| CVE-2026-72588 | 5.3 | 34.8 | — | bluewave-labs Checkmate - User Enumeration via Differential HTTP Response in Password R… |
| CVE-2026-42218 | 5.3 | 34.6 | — | XRDP is vulnerable to a server timing attack, leading to user enumeration |
| CVE-2026-86758 | 7.1 | 33.9 | — | Snipe-IT before 8.7.0 License Key Exposure via CSV Export |
| CVE-2026-75575 | 6.9 | 32.4 | — | Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method |
| CVE-2026-111235 | 9.1 | 30.0 | — | OpenNMS REST authorization bypass via non-canonical HTTP method |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| red hat | 3 |
| amazon | 1 |
| automatisch | 1 |
| bilin software and informatics consultancy | 1 |
| bluewave-labs | 1 |
| budibase | 1 |
| combodo | 1 |
| contao | 1 |
| cyrusimap | 1 |
| dernekplus | 1 |
| discord | 1 |
| eclipse foundation | 1 |
| elastic | 1 |
| erlang | 1 |
| filamentphp | 1 |
