Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-285
Weakness type CWE-285 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 498 | 486 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▆▇▆█▄
2025-11 0 · 2025-12 0 · 2026-01 2 · 2026-02 1 · 2026-03 4 · 2026-04 3 · 2026-05 24 · 2026-06 82 · 2026-07 111 · 2026-08 83 · 2026-09 123 · 2026-10 53
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-28799 | 10.0 | 99.6 | KEV | Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) |
| CVE-2026-58704 | 8.8 | 47.2 | KEV | — |
| CVE-2025-29794 | 8.8 | 91.8 | — | Microsoft SharePoint Remote Code Execution Vulnerability |
| CVE-2026-10580 | 9.8 | 86.9 | — | Hippoo Mobile App for WooCommerce <= 1.9.4 - Unauthenticated Authentication Bypass to A… |
| CVE-2024-38231 | 7.5 | 79.0 | — | Windows Remote Desktop Licensing Service Denial of Service Vulnerability |
| CVE-2026-33186 | 9.1 | 76.7 | — | gRPC-Go has an authorization bypass via missing leading slash in :path |
| CVE-2024-38129 | 7.5 | 69.3 | — | Windows Kerberos Elevation of Privilege Vulnerability |
| CVE-2024-43482 | 6.5 | 65.1 | — | Microsoft Outlook for iOS Information Disclosure Vulnerability |
| CVE-2025-30392 | 9.8 | 64.9 | — | Azure AI Bot Elevation of Privilege Vulnerability |
| CVE-2026-48579 | 7.5 | 62.2 | — | Microsoft Exchange Online Information Disclosure Vulnerability |
| CVE-2026-100885 | 5.5 | 62.1 | — | Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization |
| CVE-2026-47298 | 8.0 | 61.5 | — | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-27823 | 8.7 | 61.4 | — | Remote Code Execution Vulnerability in EGroupware |
| CVE-2026-62835 | 7.5 | 61.4 | — | Azure Portal Information Disclosure Vulnerability |
| CVE-2025-30390 | 9.9 | 61.0 | — | Azure ML Compute Elevation of Privilege Vulnerability |
| CVE-2026-58277 | 8.8 | 60.2 | — | Microsoft SharePoint Elevation of Privilege Vulnerability |
| CVE-2026-32213 | 10.0 | 59.0 | — | Azure AI Foundry Elevation of Privilege Vulnerability |
| CVE-2026-33105 | 10.0 | 59.0 | — | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability |
| CVE-2025-30389 | 8.7 | 58.4 | — | Azure Bot Framework SDK Elevation of Privilege Vulnerability |
| CVE-2026-33823 | 9.6 | 57.8 | — | Microsoft Team Events Portal Information Disclosure Vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 37 |
| ibm | 24 |
| sourcecodester | 17 |
| apple | 15 |
| oracle | 12 |
| apache | 11 |
| capgo | 10 |
| eleveo | 10 |
| misp | 10 |
| astrbotdevs | 6 |
| berriai | 6 |
| nextlevelbuilder | 6 |
| openidentityplatform | 6 |
| webkul | 5 |
| cisco | 4 |
