Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-304
Weakness type CWE-304 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 17 | 17 | 0 |
Monthly trend
▂▁▄▄▇█▅
2026-04 1 · 2026-05 0 · 2026-06 2 · 2026-07 2 · 2026-08 4 · 2026-09 5 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-54391 | 9.3 | 87.4 | — | Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter |
| CVE-2026-55957 | 7.3 | 86.5 | — | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind |
| CVE-2026-61466 | 9.1 | 52.6 | — | Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation |
| CVE-2026-40542 | 7.3 | 52.3 | — | Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to a… |
| CVE-2026-49467 | 8.8 | 48.5 | — | TOTP enrollment hijack: password gate skipped due to unawaited promise |
| CVE-2026-67351 | 8.7 | 45.1 | — | Serendipity < 2.6.1 Authentication Bypass via Username Collision |
| CVE-2026-59564 | 9.1 | 43.5 | — | Authentication bypass between ZCC and client connector portal |
| CVE-2026-57915 | 7.3 | 43.3 | — | Apache Kerby: Kerberos Pre-Authentication Bypass |
| CVE-2026-108071 | 8.7 | 39.2 | — | Improper Multi-Factor Authentication Validation Allows Authentication Bypass |
| CVE-2026-76207 | 8.6 | 38.2 | — | phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie |
| CVE-2026-89068 | 8.1 | 38.1 | — | MOVEit Transfer Authentication bypass in LDAP sign-on |
| CVE-2026-54723 | 6.5 | 36.3 | — | devpi: Database contents leak |
| CVE-2026-94052 | 9.1 | 30.6 | — | Apache MINA SSHD: LDAP password authentication ineffective |
| CVE-2026-93994 | 8.1 | 22.8 | — | Apache MINA SSHD: Repeated-publickey policy bypass on server |
| CVE-2026-61143 | 6.4 | 22.8 | — | — |
| CVE-2026-100667 | 6.9 | 22.0 | — | grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass |
| CVE-2026-73535 | 8.8 | 9.2 | — | Gitea second-factor bypass through OpenID identity linking |
