Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-321
Weakness type CWE-321 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 125 | 119 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▄▃▅█▇
2025-11 1 · 2025-12 1 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 4 · 2026-06 14 · 2026-07 11 · 2026-08 21 · 2026-09 37 · 2026-10 32
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-30406 | 9.0 | 99.9 | KEV | Gladinet CentreStack |
| CVE-2016-4437 | 9.8 | 99.8 | KEV | Apache Shiro |
| CVE-2026-74233 | 9.3 | 88.6 | — | Zbtlink MQWrt infosrvd Command Injection |
| CVE-2026-86708 | 10.0 | 68.8 | — | Sensitive data exposure |
| CVE-2023-21705 | 8.8 | 65.7 | — | Microsoft SQL Server Remote Code Execution Vulnerability |
| CVE-2026-75431 | 9.1 | 64.3 | — | — |
| CVE-2026-110612 | 9.3 | 62.0 | — | vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil |
| CVE-2026-35019 | 9.2 | 56.0 | — | NetComm NF20MESH < R6B032 Hardcoded AES Key Authentication Bypass |
| CVE-2026-90945 | 9.3 | 54.6 | — | Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret |
| CVE-2026-28326 | 8.8 | 52.0 | — | SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability |
| CVE-2025-34256 | 10.0 | 51.9 | — | Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass |
| CVE-2026-54363 | 9.3 | 51.7 | — | CentreStack < 17.5 Hardcoded Key Token Forgery RCE |
| CVE-2026-89026 | 9.3 | 51.7 | — | Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate |
| CVE-2025-15627 | 6.9 | 51.3 | — | Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication |
| CVE-2026-62241 | 9.3 | 51.0 | — | clawvet < 0.7.5 Hard-coded JWT Secret Session Forgery |
| CVE-2026-56271 | 9.3 | 50.3 | — | Flowise - Weak Default JWT Secrets in Authentication Middleware |
| CVE-2026-47410 | 9.8 | 49.5 | — | praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allow… |
| CVE-2026-111692 | 9.3 | 48.0 | — | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret |
| CVE-2026-24218 | 8.1 | 47.5 | — | — |
| CVE-2026-52727 | 7.2 | 47.3 | — | lxc-ci: Pacman keyring stored in archlinux image with a private key |
