Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-294
Weakness type CWE-294 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 85 | 84 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▃▆██▄
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 5 · 2026-06 8 · 2026-07 17 · 2026-08 22 · 2026-09 23 · 2026-10 9
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-20900 | 7.5 | 73.2 | — | — |
| CVE-2026-55250 | 8.7 | 58.0 | — | Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Ta… |
| CVE-2026-69676 | 8.8 | 55.0 | — | Windows Kerberos Remote Code Execution Vulnerability |
| CVE-2026-73683 | 9.2 | 54.4 | — | Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay |
| CVE-2026-16083 | 5.5 | 53.0 | — | Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay |
| CVE-2026-53431 | 9.1 | 52.3 | — | Boruta accepts expired JWT client assertions due to missing exp claim validation |
| CVE-2026-62911 | 8.0 | 52.0 | — | Microsoft Exchange Server Elevation of Privilege Vulnerability |
| CVE-2026-47341 | 6.3 | 51.8 | — | Apache APISIX: Session replay issue in hmac-auth |
| CVE-2026-11856 | 9.8 | 51.8 | — | cross-origin Digest auth state leak |
| CVE-2026-28564 | 9.8 | 51.5 | — | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials |
| CVE-2026-68079 | 9.8 | 51.5 | — | Apache CXF: DefaultEncryptingCodeDataProvider allows unlimited authorization code replay |
| CVE-2026-53424 | 9.1 | 47.7 | — | Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions |
| CVE-2026-84003 | 7.4 | 47.6 | — | Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability |
| CVE-2026-67581 | 8.7 | 47.4 | — | On-chain transfer proof is not single-use in mpp EVM payment method, enabling cross-cha… |
| CVE-2026-73136 | 8.2 | 47.4 | — | Static memo configuration in mpp Tempo disables per-challenge attribution binding, enab… |
| CVE-2026-54148 | 8.1 | 46.6 | — | http4k: `DigestAuthProvider.verify` did not bind to request URI |
| CVE-2026-87119 | 8.2 | 46.3 | — | mpp Tempo subscription key authorization is not bound to the issuing challenge, allowin… |
| CVE-2026-65905 | 9.8 | 45.6 | — | Apache Tomcat: Limited replay attack possible with DIGEST authentication |
| CVE-2026-57574 | 7.4 | 44.9 | — | Misskey: TOTP tokens can be reused |
| CVE-2026-46369 | 7.5 | 44.8 | — | Nimiq: Validity store off by one error |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 8 |
| microsoft | 4 |
| curl | 3 |
| hcl software | 3 |
| ibm | 3 |
| zenhive | 3 |
| corewcf | 2 |
| devolutions | 2 |
| gitea | 2 |
| http4k | 2 |
| red hat | 2 |
| spring | 2 |
| suse | 2 |
| xenforo | 2 |
| alps electric co | 1 |
