Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-23
Weakness type CWE-23 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 147 | 138 | 5 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▄▄█▆▇▅
2025-11 1 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 0 · 2026-04 0 · 2026-05 14 · 2026-06 16 · 2026-07 34 · 2026-08 24 · 2026-09 29 · 2026-10 20
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-27199 | 7.3 | 100.0 | KEV | JetBrains TeamCity |
| CVE-2020-5410 | 7.5 | 99.9 | KEV | Directory Traversal with spring-cloud-config-server |
| CVE-2025-64446 | 9.8 | 99.8 | KEV | Fortinet FortiWeb |
| CVE-2026-76519 | 9.8 | 75.0 | KEV | Cisco Secure Email Gateway Arbitrary File Write Vulnerability |
| CVE-2026-34926 | 6.7 | 44.1 | KEV | Trend Micro Apex One |
| CVE-2024-43454 | 7.1 | 97.6 | — | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability |
| CVE-2026-23734 | 9.3 | 97.2 | — | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when us… |
| CVE-2023-35359 | 7.8 | 95.5 | — | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2024-38258 | 7.5 | 91.7 | — | Windows Remote Desktop Licensing Service Information Disclosure Vulnerability |
| CVE-2023-38185 | 8.8 | 85.6 | — | Microsoft Exchange Server Remote Code Execution Vulnerability |
| CVE-2026-54066 | 7.5 | 83.7 | — | SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary… |
| CVE-2026-16053 | 8.5 | 77.7 | — | Path Traversal |
| CVE-2026-51026 | 6.5 | 69.0 | — | — |
| CVE-2026-62837 | 6.5 | 68.5 | — | Microsoft SharePoint Server Information Disclosure Vulnerability |
| CVE-2026-14903 | 6.5 | 67.3 | — | — |
| CVE-2023-40772 | 4.3 | 66.2 | — | — |
| CVE-2026-8134 | 9.4 | 65.5 | — | Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemp… |
| CVE-2026-52813 | 10.0 | 65.3 | — | Gogs: Path Traversal in organization name results in RCE through Git hooks |
| CVE-2026-67367 | 9.2 | 65.3 | — | — |
| CVE-2026-56196 | 8.8 | 62.9 | — | Windows Admin Center (WAC) Remote Code Execution Vulnerability |
