Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-330
Weakness type CWE-330 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 52 | 47 | 0 |
Monthly trend
▂▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▅▄▇█▄
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 1 · 2026-06 8 · 2026-07 5 · 2026-08 12 · 2026-09 14 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-14422 | 5.9 | 96.3 | — | — |
| CVE-2021-20322 | 7.4 | 94.0 | — | — |
| CVE-2020-11501 | 7.4 | 88.6 | — | — |
| CVE-2026-11374 | 9.0 | 84.6 | — | Account Takeover via Predictable SSO Ticket Generation |
| CVE-2026-66047 | 9.2 | 59.7 | — | ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE |
| CVE-2026-82555 | 2.9 | 50.8 | — | TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values |
| CVE-2026-66391 | 6.5 | 49.5 | — | Apache Wicket: leaked and missing CSP headers |
| CVE-2026-80154 | 8.9 | 49.0 | — | Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass |
| CVE-2024-52615 | 5.3 | 45.5 | — | Avahi: avahi wide-area dns uses constant source port |
| CVE-2026-62862 | 9.1 | 43.5 | — | TypeBot: Account takeover via brute-forceable 6-digit magic-link code |
| CVE-2026-92913 | 9.1 | 43.5 | — | AVideo Weak PRNG Activation Code Authentication Bypass |
| CVE-2026-81852 | 2.1 | 43.4 | — | AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass |
| CVE-2026-94456 | 9.1 | 43.1 | — | Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization … |
| CVE-2026-19407 | 7.7 | 43.0 | — | GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK |
| CVE-2026-71225 | 6.5 | 43.0 | — | Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state r… |
| CVE-2026-14570 | 7.5 | 42.1 | — | Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key fro… |
| CVE-2026-19906 | 6.3 | 41.0 | — | pkp pkp-lib API Key Generation APIProfileForm.php setData entropy |
| CVE-2026-44054 | 6.5 | 40.8 | — | Predictable afpd session token |
| CVE-2026-19748 | 2.9 | 40.7 | — | Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy |
| CVE-2026-19896 | 2.9 | 40.7 | — | mangroup dtale Flask Session Cookie app.py build_secret_key random values |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| netty | 3 |
| wwbn | 3 |
| google cloud | 2 |
| ibm | 2 |
| red hat | 2 |
| spring | 2 |
| acer | 1 |
| adguardteam | 1 |
| apache | 1 |
| apple | 1 |
| ash-project | 1 |
| baptistearno | 1 |
| bigbluebutton | 1 |
| combodo | 1 |
| daext | 1 |
