Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-250
Weakness type CWE-250 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 89 | 77 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▂▁▁▂▁▁▁▁▂▆▅▆█▄
2025-11 0 · 2025-12 2 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 3 · 2026-06 15 · 2026-07 12 · 2026-08 15 · 2026-09 21 · 2026-10 10
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-38813 | 7.5 | 97.1 | KEV | Privilege escalation vulnerability |
| CVE-2025-40602 | 6.6 | 86.0 | KEV | SonicWall SMA1000 appliance |
| CVE-2024-7387 | 9.1 | 83.2 | — | Openshift/builder: path traversal allows command injection in privileged buildcontainer… |
| CVE-2024-43583 | 7.8 | 70.9 | — | Winlogon Elevation of Privilege Vulnerability |
| CVE-2023-5207 | 8.2 | 68.7 | — | Execution with Unnecessary Privileges in GitLab |
| CVE-2026-54501 | 9.4 | 68.1 | — | Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git UR… |
| CVE-2026-77521 | 10.0 | 63.7 | — | MaxKB: Prompt-injectable agent can lead to command execution |
| CVE-2026-69409 | 6.5 | 62.0 | — | Microsoft Office SharePoint Information Disclosure Vulnerability |
| CVE-2026-42833 | 9.1 | 60.0 | — | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability |
| CVE-2026-48584 | 8.8 | 59.4 | — | Microsoft Azure Synapse Elevation of Privilege Vulnerability |
| CVE-2026-59133 | 8.8 | 59.4 | — | Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability |
| CVE-2026-69464 | 8.8 | 59.4 | — | Microsoft Office SharePoint Elevation of Privilege Vulnerability |
| CVE-2026-84787 | 8.1 | 57.3 | — | Privilege Escalation vulnerability |
| CVE-2026-72508 | 9.9 | 56.1 | — | Multicloud-operators-subscription: multicloud-operators-subscription: hub and spoke ser… |
| CVE-2026-18982 | 8.8 | 55.5 | — | Odh-training-operator-rhel9: rhoai fork aggregates training job create onto native edit… |
| CVE-2026-17110 | 8.8 | 54.0 | — | IBM i is Affected By Multiple Vulnerabilities in SQL |
| CVE-2026-18669 | 8.8 | 54.0 | — | IBM i is Affected By A Privilege Escalation Vulnerability [] |
| CVE-2026-18608 | 8.7 | 52.2 | — | Data-science-pipelines-operator: dspo: operator clusterrole grants pods/exec:*, kubeflo… |
| CVE-2026-9209 | 9.3 | 51.9 | — | mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx |
| CVE-2026-65162 | 10.0 | 50.6 | — | — |
