Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-266
Weakness type CWE-266 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 422 | 415 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▃█▅▇▇▅
2025-11 2 · 2025-12 0 · 2026-01 3 · 2026-02 1 · 2026-03 1 · 2026-04 0 · 2026-05 23 · 2026-06 101 · 2026-07 51 · 2026-08 93 · 2026-09 81 · 2026-10 61
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-48172 | 10.0 | 62.5 | KEV | LiteSpeed cPanel Plugin |
| CVE-2025-41115 | 9.8 | 97.0 | — | Incorrect privilege assignment |
| CVE-2025-34112 | 10.0 | 86.4 | — | Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 RCE |
| CVE-2026-49060 | 9.8 | 75.9 | — | WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Privilege Escalation vuln… |
| CVE-2026-15270 | 6.8 | 57.5 | — | D-link DIR-823G Web boa.conf least privilege violation |
| CVE-2026-44173 | 5.3 | 57.2 | — | MariaDB: FILE privilege was not checked for subqueries in the FROM clause |
| CVE-2026-102129 | 7.2 | 57.0 | — | Kiteworks Core Incorrect Privilege Assignment |
| CVE-2026-105284 | 9.3 | 55.2 | — | Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization |
| CVE-2026-9397 | 8.2 | 54.6 | — | Besen BS20 EV Charging Station OTA Update Installation improper authorization |
| CVE-2026-86153 | 9.4 | 52.8 | — | Tenda CP3 Redirect.cpp SetRedirectEnable privileges management |
| CVE-2026-59093 | 8.7 | 52.6 | — | Weaviate < 1.38.0 - Privilege Escalation via Unchecked Permissions in RBAC Role Assignment |
| CVE-2026-15271 | 7.7 | 52.4 | — | TOTOLINK EX200 Web boa.conf least privilege violation |
| CVE-2026-15218 | 7.9 | 52.2 | — | Models-as-a-service: red hat openshift ai: maas-api and maas-controller serviceaccounts… |
| CVE-2026-86830 | 8.6 | 51.9 | — | Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS I… |
| CVE-2026-78330 | 9.8 | 49.7 | — | Apache Syncope: Privilege escalation for admin user via JWT authentication |
| CVE-2025-53744 | 6.8 | 49.6 | — | — |
| CVE-2026-10059 | 9.1 | 49.6 | — | Cluster-curator-controller: cluster-curator-controller: namespace admin can escalate to… |
| CVE-2026-86804 | 6.9 | 49.5 | — | seakee CPA-Manager-Plus HTTP handler.go CPAResource improper authorization |
| CVE-2026-14792 | 6.9 | 49.1 | — | Formbricks Survey actions.ts access control |
| CVE-2026-15467 | 8.1 | 47.5 | — | Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypa… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| sourcecodester | 19 |
| red hat | 15 |
| eleveo | 11 |
| d-link | 6 |
| totolink | 5 |
| berriai | 4 |
| cosmicstack-labs | 4 |
| cozy vision technologies pvt | 4 |
| gitea | 4 |
| nextlevelbuilder | 4 |
| talelin | 4 |
| theonedev | 4 |
| aomei | 3 |
| iobit | 3 |
| jetbrains | 3 |
