Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-212
Weakness type CWE-212 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 28 | 25 | 0 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▃▄▂█▃
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 2 · 2026-05 2 · 2026-06 3 · 2026-07 4 · 2026-08 1 · 2026-09 10 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-49997 | 7.5 | 64.1 | — | net: ethernet: lantiq_etop: fix memory disclosure |
| CVE-2026-40895 | 6.9 | 56.5 | — | follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets |
| CVE-2026-62900 | 5.9 | 54.0 | — | .NET Information Disclosure Vulnerability |
| CVE-2024-43554 | 5.5 | 49.5 | — | Windows Kernel-Mode Driver Information Disclosure Vulnerability |
| CVE-2026-42880 | 9.6 | 45.7 | — | ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction |
| CVE-2026-45737 | 6.5 | 43.0 | — | Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations |
| CVE-2026-107291 | 2.3 | 42.8 | — | Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans… |
| CVE-2026-54421 | 6.8 | 39.2 | — | — |
| CVE-2026-16104 | 6.5 | 38.1 | — | Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptc… |
| CVE-2026-46657 | 7.1 | 36.5 | — | Bludit's persistent authentication tokens not revoked upon account disablement |
| CVE-2026-20928 | 4.6 | 35.8 | — | Windows Recovery Environment Security Feature Bypass Vulnerability |
| CVE-2026-85094 | 8.8 | 35.5 | — | — |
| CVE-2026-82069 | 5.1 | 33.7 | — | Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization o… |
| CVE-2026-67071 | 6.5 | 30.2 | — | HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Infor… |
| CVE-2026-78658 | 6.5 | 30.2 | — | IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclos… |
| CVE-2026-90860 | 7.1 | 21.8 | — | — |
| CVE-2022-0171 | 5.5 | 21.1 | — | — |
| CVE-2026-107293 | 2.3 | 20.9 | — | Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `i… |
| CVE-2026-86740 | 5.1 | 20.3 | — | Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains |
| CVE-2026-73440 | 2.3 | 17.5 | — | Security Advisory 0178 |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 3 |
| argoproj | 2 |
| canva | 2 |
| ibm | 2 |
| pydantic | 2 |
| red hat | 2 |
| arista networks | 1 |
| bludit | 1 |
| canonical | 1 |
| follow-redirects | 1 |
| forgekeep | 1 |
| grokability | 1 |
| hclsoftware | 1 |
| linux | 1 |
| mongodb | 1 |
