Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-289
Weakness type CWE-289 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 24 | 23 | 0 |
Monthly trend
▂▁▂▁▂▂▇▅▆█▃
2025-12 1 · 2026-01 0 · 2026-02 1 · 2026-03 0 · 2026-04 1 · 2026-05 1 · 2026-06 5 · 2026-07 3 · 2026-08 4 · 2026-09 6 · 2026-10 2
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-48618 | 6.5 | 88.1 | — | — |
| CVE-2026-44492 | 8.6 | 55.2 | — | Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PRO… |
| CVE-2026-50627 | 9.1 | 54.9 | — | Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator |
| CVE-2026-8457 | 9.8 | 52.4 | — | WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged … |
| CVE-2026-56091 | 8.2 | 51.0 | — | Apache Shiro: Authentication bypass in Guice-Web integration |
| CVE-2026-53622 | 7.8 | 49.1 | — | Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case… |
| CVE-2026-10842 | 7.5 | 43.3 | — | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected … |
| CVE-2026-100351 | 7.4 | 40.7 | — | kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation c… |
| CVE-2026-9701 | 9.8 | 40.0 | — | Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escal… |
| CVE-2026-55075 | 7.4 | 39.9 | — | Coder vulnerable to OIDC account takeover via email-based user matching and email_verif… |
| CVE-2026-32639 | 6.8 | 38.4 | — | Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions … |
| CVE-2026-15980 | 9.8 | 38.0 | — | MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token |
| CVE-2026-3184 | 5.3 | 36.5 | — | Util-linux: util-linux: access control bypass due to improper hostname canonicalization |
| CVE-2026-23903 | 5.3 | 32.9 | — | Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems |
| CVE-2026-76183 | 9.8 | 31.5 | — | Apache Tomcat: Bypass of security constraints for WebSocket endpoints |
| CVE-2026-73511 | 5.3 | 30.0 | — | Envoy: Potential path-matching/authentication bypass when using Envoy in combination wi… |
| CVE-2025-14777 | 6.0 | 26.5 | — | Keycloak: keycloak idor in realm client creating/deleting |
| CVE-2026-15985 | 8.1 | 24.0 | — | Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authenticati… |
| CVE-2026-43617 | 6.3 | 22.9 | — | Rsync < 3.4.3 Authorization Bypass via Hostname Resolution |
| CVE-2026-12101 | 8.1 | 18.2 | — | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Secu… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 4 |
| ibm | 2 |
| red hat | 2 |
| axios | 1 |
| coder | 1 |
| dataease | 1 |
| envoyproxy | 1 |
| getkin | 1 |
| joe007 | 1 |
| netgsm | 1 |
| nodejs | 1 |
| python-social-auth | 1 |
| radiustheme | 1 |
| rsyncproject | 1 |
| tangiblewp | 1 |
