Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-276
Weakness type CWE-276 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 97 | 80 | 3 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▂▁▁▁▁▂▁▁▁▁▁▁▁▁▄▇▇██▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 1 · 2026-05 7 · 2026-06 14 · 2026-07 14 · 2026-08 17 · 2026-09 16 · 2026-10 10
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2013-0632 | 9.8 | 99.8 | KEV | Adobe ColdFusion |
| CVE-2022-22948 | 6.5 | 96.4 | KEV | VMware vCenter Server |
| CVE-2026-87886 | 7.8 | 13.2 | KEV | — |
| CVE-2022-32207 | 9.8 | 96.2 | — | — |
| CVE-2023-20178 | 7.8 | 92.6 | — | — |
| CVE-2024-38222 | 6.5 | 67.5 | — | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
| CVE-2025-29801 | 7.8 | 64.1 | — | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
| CVE-2020-8022 | 7.8 | 57.7 | — | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation… |
| CVE-2026-17497 | 8.3 | 54.1 | — | NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python |
| CVE-2026-75166 | 8.8 | 53.9 | — | — |
| CVE-2026-49157 | 8.8 | 49.0 | — | Apache ActiveMQ: Authenticated low-privilege Web users retain Jolokia broker-management… |
| CVE-2026-52766 | 9.1 | 46.5 | — | YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action |
| CVE-2024-46695 | 4.4 | 43.6 | — | selinux,smack: don't bypass permissions check in inode_setsecctx hook |
| CVE-2026-33590 | 8.5 | 42.5 | — | Insecure default permissions in Portainer CE |
| CVE-2026-77393 | 8.7 | 41.9 | — | Inductive Automation Ignition Incorrect Default Permissions |
| CVE-2025-8031 | 9.8 | 41.0 | — | Incorrect URL stripping in CSP reports |
| CVE-2026-19893 | 2.3 | 39.6 | — | D-Link DIR-842 vsftpd vsftpd.conf default permission |
| CVE-2023-54366 | 8.7 | 38.6 | — | SurrealDB before 1.0.1 Insecure Default Table Permissions |
| CVE-2026-59119 | 7.3 | 30.6 | — | PowerShell Elevation of Privilege Vulnerability |
| CVE-2026-48725 | 8.1 | 30.2 | — | Warp may allow terminal output to access the local clipboard through OSC 52 |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| dell | 5 |
| microsoft | 4 |
| red hat | 4 |
| xen | 3 |
| amd | 2 |
| apache | 2 |
| apple | 2 |
| aws | 2 |
| bizerba se & co. kg | 2 |
| codesys | 2 |
| lenovo | 2 |
| otrs | 2 |
| progress | 2 |
| rockwell automation | 2 |
| samsung mobile | 2 |
