Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-209
Weakness type CWE-209 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 112 | 105 | 3 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▃▄▅▆█▆
2025-11 0 · 2025-12 0 · 2026-01 2 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 9 · 2026-06 10 · 2026-07 16 · 2026-08 19 · 2026-09 27 · 2026-10 21
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-29059 | 7.5 | 99.9 | KEV | .NET Framework Information Disclosure Vulnerability |
| CVE-2025-47813 | 4.3 | 99.2 | KEV | Wing FTP Server Wing FTP Server |
| CVE-2013-7331 | 6.5 | 98.9 | KEV | Microsoft Internet Explorer |
| CVE-2026-29146 | 7.5 | 86.7 | — | Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default |
| CVE-2018-12886 | 8.1 | 85.9 | — | — |
| CVE-2026-67383 | 6.5 | 62.0 | — | Microsoft SQL Server Information Disclosure Vulnerability |
| CVE-2026-66306 | 6.5 | 59.6 | — | Skype for Business Information Disclosure Vulnerability |
| CVE-2026-69552 | 5.7 | 58.8 | — | Windows Print Spooler Components Information Disclosure Vulnerability |
| CVE-2018-10624 | 4.3 | 58.3 | — | Johnson Controls Metasys and BCPro Generation of Error Message Containing Sensitive Inf… |
| CVE-2026-20838 | 5.5 | 50.2 | — | Windows Kernel Information Disclosure Vulnerability |
| CVE-2026-9794 | 5.3 | 46.3 | — | Keycloak: keycloak: information disclosure via saml ecp endpoint |
| CVE-2026-49365 | 5.3 | 46.2 | — | Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, s… |
| CVE-2026-56139 | 5.3 | 46.2 | — | Apache Camel Undertow: The muteException consumer option defaulted to false, so a proce… |
| CVE-2026-66008 | 6.3 | 45.4 | — | Parse Server 9.0.0 Information Disclosure via GraphQL Error Messages |
| CVE-2026-77950 | 6.3 | 44.6 | — | RPC error handler fails open in AshTypescript, disclosing unredacted errors |
| CVE-2026-82733 | 6.3 | 44.6 | — | Route handler return value echoed into AshTypescript error response |
| CVE-2026-78693 | 6.9 | 43.2 | — | Incomplete redaction re-attaches the original error path in AshGraphql, leaking interna… |
| CVE-2026-53906 | 5.1 | 42.9 | — | Path Disclosure and Path Traversal in MCO |
| CVE-2026-47248 | 6.9 | 41.9 | — | Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthen… |
| CVE-2026-13182 | 7.5 | 41.3 | — | RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 10 |
| microsoft | 9 |
| ash-project | 8 |
| apache | 7 |
| hcl software | 7 |
| parse-community | 5 |
| red hat | 5 |
| hclsoftware | 4 |
| spring | 4 |
| dell | 2 |
| givanz | 2 |
| hcl | 2 |
| appsmithorg | 1 |
| capgo | 1 |
| codriapp innovation and software technologies | 1 |
