Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-281
Weakness type CWE-281 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 26 | 23 | 1 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▅▃▃▃█▂
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 5 · 2026-06 3 · 2026-07 2 · 2026-08 2 · 2026-09 9 · 2026-10 1
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2017-8543 | 9.8 | 99.5 | KEV | Microsoft Windows |
| CVE-2024-1726 | 5.3 | 53.3 | — | Quarkus: security checks for some inherited endpoints performed after serialization in … |
| CVE-2026-39832 | 9.1 | 52.8 | — | Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent |
| CVE-2026-35385 | 8.1 | 49.3 | — | — |
| CVE-2026-39828 | 6.3 | 44.1 | — | Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh |
| CVE-2026-4360 | 2.0 | 40.1 | — | Tarfile.extract() doesn't fully respect filter parameter |
| CVE-2026-44832 | 8.7 | 37.0 | — | Snipe-IT: Privilege Escalation via API Permissions Assignment |
| CVE-2026-40767 | 7.5 | 32.0 | — | WordPress wpForo Forum plugin < 3.0.2 - Broken Access Control vulnerability |
| CVE-2026-44947 | 6.9 | 31.3 | — | Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher |
| CVE-2026-61709 | 5.3 | 27.2 | — | OpenFGA: ListUsers returns a deliberately-excluded user (authorization-decision over-in… |
| CVE-2026-58510 | 4.3 | 24.7 | — | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… |
| CVE-2025-14779 | 3.8 | 23.2 | — | Improper Access Control via Secret Type Management API in WSO2 Identity Server |
| CVE-2026-101306 | 9.8 | 17.7 | — | Multiple jail filesystem root escapes |
| CVE-2022-4139 | 7.8 | 16.5 | — | — |
| CVE-2024-47270 | 2.7 | 15.1 | — | — |
| CVE-2026-88016 | 7.1 | 7.8 | — | rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in r… |
| CVE-2026-58494 | 6.5 | 6.1 | — | Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination |
| CVE-2026-82964 | 8.8 | 4.4 | — | Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx… |
| CVE-2026-24194 | 7.8 | 3.9 | — | — |
| CVE-2026-47596 | 7.0 | 3.3 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| nvidia | 5 |
| golang.org/x/crypto | 2 |
| bytecodealliance | 1 |
| freebsd | 1 |
| gen digital | 1 |
| gitea | 1 |
| grokability | 1 |
| hashicorp | 1 |
| microsoft | 1 |
| openbsd | 1 |
| openfga | 1 |
| python software foundation | 1 |
| rclone | 1 |
| red hat | 1 |
| suse | 1 |
