Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-252
Weakness type CWE-252 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 37 | 28 | 0 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▂▁▁▁▁▁▁▂▁▁▁▁▁▁▁▂▁▁▁▁▁▁▂▂▃▅█▆
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 1 · 2026-06 2 · 2026-07 3 · 2026-08 5 · 2026-09 10 · 2026-10 7
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-4189 | 5.3 | 88.7 | — | — |
| CVE-2020-6078 | 7.5 | 87.7 | — | — |
| CVE-2021-3998 | 7.5 | 82.3 | — | — |
| CVE-2026-40092 | 7.5 | 54.3 | — | nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote… |
| CVE-2026-11972 | 8.2 | 52.8 | — | tarfile opened in streaming mode mishandles EOF |
| CVE-2025-58903 | 4.9 | 48.8 | — | — |
| CVE-2023-52687 | 5.5 | 47.7 | — | crypto: safexcel - Add error handling for dma_map_sg() calls |
| CVE-2026-26080 | 3.7 | 44.6 | — | — |
| CVE-2026-14957 | 7.5 | 39.1 | — | FIPS mode assertion failure via malicious CERT payload |
| CVE-2026-48503 | 7.5 | 38.3 | — | libIEC61850: Remote information disclosure in MMS file service via out-of-range initial… |
| CVE-2026-48741 | 7.5 | 36.0 | — | libIEC61850: Remote NULL dereference in MMS Read alternate-access sub-array path leads … |
| CVE-2026-67409 | 8.2 | 34.6 | — | RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes… |
| CVE-2026-19534 | 7.5 | 32.0 | — | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol |
| CVE-2026-47245 | 4.3 | 29.0 | — | MyBB: Buddy list corruption |
| CVE-2026-86739 | 2.3 | 27.8 | — | Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence |
| CVE-2026-77641 | 8.2 | 27.4 | — | — |
| CVE-2026-79772 | 6.9 | 26.1 | — | Nokogiri before 1.19.1 Unchecked Return Value canonicalize |
| CVE-2026-77207 | 7.5 | 25.8 | — | Null Pointer Dereference in PKCS#7 bundle with no certificates |
| CVE-2026-107838 | 7.5 | 25.8 | — | RIOT: nanocoap_fileserver ignores response initialization failure, leading to reachable… |
| CVE-2026-86749 | 7.0 | 25.8 | — | snipe-it before 8.7.0 Data Loss via Failed Image Write |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| linux | 4 |
| grokability | 2 |
| imagemagick | 2 |
| mz-automation | 2 |
| the libreswan project | 2 |
| ash-project | 1 |
| chewkeanho | 1 |
| dell | 1 |
| fortinet | 1 |
| gnu | 1 |
| 1 | |
| haproxy | 1 |
| microsoft | 1 |
| mongodb | 1 |
| mybb | 1 |
