Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-312
Weakness type CWE-312 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 99 | 94 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▂▂▃█▆▄
2025-11 0 · 2025-12 1 · 2026-01 0 · 2026-02 1 · 2026-03 3 · 2026-04 1 · 2026-05 4 · 2026-06 6 · 2026-07 10 · 2026-08 33 · 2026-09 23 · 2026-10 13
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-22894 | 4.9 | 89.3 | KEV | — |
| CVE-2011-4723 | 5.7 | 87.4 | KEV | D-Link DIR-300 Router |
| CVE-2026-23655 | 6.5 | 62.7 | — | Microsoft ACI Confidential Containers Information Disclosure Vulnerability |
| CVE-2026-83551 | 8.5 | 55.8 | — | Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipe… |
| CVE-2026-15065 | 9.1 | 49.2 | — | Vulnerabilities in IBM AIX and PowerVM VIOS |
| CVE-2024-4540 | 7.5 | 44.9 | — | Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_r… |
| CVE-2026-31848 | 8.7 | 38.2 | — | Reversible ecos_pw Cookie Allows Authentication Bypass in Nexxt Nebula 300+ |
| CVE-2026-27877 | 6.5 | 32.5 | — | Public dashboards discloses all direct mode datasources |
| CVE-2026-13380 | 9.0 | 31.9 | — | VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses |
| CVE-2026-42151 | 7.5 | 27.3 | — | Prometheus Azure AD remote write OAuth client secret exposed via config API |
| CVE-2026-53603 | 7.1 | 27.3 | — | nebula-mesh: Operator session tokens stored in plaintext in the database |
| CVE-2026-86280 | 5.5 | 27.0 | — | SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sq… |
| CVE-2026-81321 | 9.3 | 26.4 | — | CareCam CM2507 Cleartext Storage of Sensitive Information |
| CVE-2026-59657 | 7.5 | 25.5 | — | Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob |
| CVE-2026-107807 | 8.8 | 22.2 | — | Nginx UI: Node Secret Credential Exposure via URL Query Parameter |
| CVE-2026-20312 | 8.8 | 21.9 | — | Cisco Catalyst SD-WAN Security Hardening Release - Information Disclosure Vulnerabilities |
| CVE-2026-90842 | 2.9 | 22.0 | — | PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file |
| CVE-2026-63406 | 5.9 | 21.3 | — | AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI… |
| CVE-2026-47702 | 9.1 | 21.1 | — | TypeBot API tokens stored in plaintext |
| CVE-2026-15721 | 9.8 | 20.7 | — | Query Console SQL Injection Leading to Sensitive Data Disclosure in Bilin Software's HU… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| splunk | 12 |
| red hat | 4 |
| apache | 3 |
| devolutions | 3 |
| ash-project | 2 |
| geovision | 2 |
| microsoft | 2 |
| mongodb | 2 |
| rabbitmq | 2 |
| 0xjacky | 1 |
| anycable | 1 |
| aws | 1 |
| baptistearno | 1 |
| bilin software and informatics consultancy | 1 |
| bosch | 1 |
