Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-305
Weakness type CWE-305 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 44 | 37 | 3 |
Monthly trend
▃▁▁▁▁▁▂▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▂▁▂▁▁▁▁▁▁▁▁▁▁▃▁▅▄▆█▆▄
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 2 · 2026-04 0 · 2026-05 5 · 2026-06 4 · 2026-07 7 · 2026-08 9 · 2026-09 6 · 2026-10 4
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-31161 | 9.8 | 100.0 | KEV | CrushFTP CrushFTP |
| CVE-2026-81578 | 8.8 | 99.7 | KEV | PaperCut MF/NG: Authentication Bypass |
| CVE-2024-37085 | 6.8 | 98.0 | KEV | VMware ESXi |
| CVE-2026-25555 | 9.3 | 85.9 | — | OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Header |
| CVE-2023-27535 | 5.9 | 78.2 | — | — |
| CVE-2023-27536 | 5.9 | 77.6 | — | — |
| CVE-2023-27538 | 5.5 | 72.9 | — | — |
| CVE-2026-86207 | 7.7 | 69.0 | — | Authentication bypass leads to unauthorised access to N-central |
| CVE-2026-19349 | 9.8 | 56.4 | — | Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, fro… |
| CVE-2026-85500 | 9.1 | 54.7 | — | `require_confirmed_with` is not enforced on the action and fails open on an unreadable … |
| CVE-2023-4501 | 9.8 | 54.3 | — | Authentication bypass in OpenText (Micro Focus) Enterprise Server |
| CVE-2026-78619 | 9.8 | 48.7 | — | Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code… |
| CVE-2024-42513 | 5.3 | 46.4 | — | — |
| CVE-2026-6266 | 8.3 | 46.2 | — | Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified e… |
| CVE-2025-14600 | 9.3 | 42.4 | — | Admin Account Takeover via Path Traversal in vsDesk |
| CVE-2026-77185 | 9.1 | 41.8 | — | Apache MINA SSHD: Asynchronous authentication can bypass signature verification |
| CVE-2026-9798 | 4.3 | 40.8 | — | Keycloak: keycloak: brute-force protection bypass in ciba flow |
| CVE-2026-3784 | 6.5 | 39.2 | — | wrong proxy connection reuse with credentials |
| CVE-2026-111283 | 9.5 | 35.3 | — | BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration |
| CVE-2026-10539 | 9.5 | 35.2 | — | Unauthenticated command injection in Control-M/Server communication command |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| curl | 4 |
| red hat | 4 |
| apache | 3 |
| mattermost | 2 |
| silabs.com | 2 |
| suse | 2 |
| 0xjacky | 1 |
| abb | 1 |
| bmc | 1 |
| bmc helix | 1 |
| crushftp | 1 |
| dell | 1 |
| devolutions | 1 |
| gitea | 1 |
| n-able | 1 |
