Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-248
Weakness type CWE-248 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 157 | 155 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▂▂▆▅▇█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 4 · 2026-04 1 · 2026-05 5 · 2026-06 9 · 2026-07 32 · 2026-08 22 · 2026-09 39 · 2026-10 43
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-37714 | 7.5 | 93.8 | — | Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw u… |
| CVE-2026-50328 | 7.5 | 68.5 | — | Windows Server Update Service (WSUS) Tampering Vulnerability |
| CVE-2026-70082 | 7.5 | 67.0 | — | Windows DNS Denial of Service Vulnerability |
| CVE-2026-69839 | 6.5 | 66.1 | — | Windows iSCSI Target Service Denial of Service Vulnerability |
| CVE-2026-92905 | 5.3 | 61.4 | — | Denial of Service Vulnerability |
| CVE-2026-31812 | 8.7 | 59.8 | — | Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing |
| CVE-2026-32641 | 7.5 | 59.7 | — | Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middle… |
| CVE-2026-2229 | 7.5 | 58.7 | — | undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid s… |
| CVE-2026-48068 | 7.5 | 58.5 | — | @grpc/grps-js: A malformed request can cause a server crash |
| CVE-2026-48069 | 7.5 | 58.5 | — | @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash |
| CVE-2026-73418 | 7.5 | 58.4 | — | NextAuth.js: getToken() throws an uncaught exception on malformed Bearer authorization … |
| CVE-2026-88099 | 5.9 | 56.4 | — | Windows Failover Cluster Denial of Service Vulnerability |
| CVE-2026-96945 | 7.5 | 56.4 | — | Windows Failover Cluster Denial of Service Vulnerability |
| CVE-2026-59892 | 7.5 | 55.3 | — | OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled excepti… |
| CVE-2026-33939 | 7.5 | 54.4 | — | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation |
| CVE-2026-64612 | 7.5 | 52.4 | — | Libcupsfilters: cups-filters: libcupsfilters: cups image filter process abort via malfo… |
| CVE-2026-44001 | 8.6 | 50.9 | — | vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) |
| CVE-2026-73088 | 7.5 | 50.6 | — | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json cu… |
| CVE-2026-59162 | 6.9 | 50.4 | — | Excelize: Negative shared-string index causes panic in GetCellValue and GetRows |
| CVE-2024-58368 | 8.7 | 50.3 | — | SurrealDB before 1.1.0 Denial of Service via HTTP Headers |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 13 |
| surrealdb | 11 |
| undici | 11 |
| microsoft | 5 |
| elastic | 4 |
| grpc | 3 |
| open-telemetry | 3 |
| patriksimek | 3 |
| rabbitmq | 3 |
| vllm-project | 3 |
| zcashfoundation | 3 |
| gallagher | 2 |
| getkin | 2 |
| gitea | 2 |
| libp2p | 2 |
