Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-331
Weakness type CWE-331 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 23 | 20 | 0 |
Monthly trend
▂▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▃▂▄█▅▂
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 2 · 2026-06 1 · 2026-07 3 · 2026-08 8 · 2026-09 4 · 2026-10 1
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2019-15847 | 7.5 | 87.9 | — | — |
| CVE-2015-8851 | 7.5 | 82.7 | — | — |
| CVE-2026-90562 | 9.2 | 53.6 | — | LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key |
| CVE-2024-6508 | 8.0 | 51.1 | — | Openshift-console: oauth2 insufficient state parameter entropy |
| CVE-2026-7210 | 6.3 | 51.1 | — | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protec… |
| CVE-2026-38447 | 9.8 | 51.1 | — | — |
| CVE-2026-13639 | 9.8 | 50.8 | — | — |
| CVE-2026-71851 | 9.0 | 44.8 | — | crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable Crypt… |
| CVE-2026-62646 | 9.1 | 42.2 | — | — |
| CVE-2026-19906 | 6.3 | 41.0 | — | pkp pkp-lib API Key Generation APIProfileForm.php setData entropy |
| CVE-2026-46473 | 7.5 | 40.9 | — | Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand |
| CVE-2026-19748 | 2.9 | 40.7 | — | Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy |
| CVE-2026-27490 | 7.5 | 36.1 | — | Combodo iTop: Weak secret generation for inline image |
| CVE-2026-41080 | 2.9 | 32.5 | — | — |
| CVE-2025-15629 | 6.9 | 24.9 | — | Weak Session Key Generation in TP-Link Omada Adoption Protocol |
| CVE-2026-11403 | 8.7 | 23.0 | — | Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation |
| CVE-2026-13199 | 5.1 | 5.2 | — | Insufficient Entropy in Raspberry Pi 5 and Compute Module 5 |
| CVE-2026-4930 | 7.1 | 2.9 | — | DPA Countermeasures weakening on Series 3 devices |
| CVE-2026-4937 | 6.0 | 2.5 | — | Power System Insufficient Entropy |
| CVE-2026-80171 | 4.7 | 1.5 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 3 |
| brix | 1 |
| combodo | 1 |
| dell | 1 |
| diem-project | 1 |
| langbot-app | 1 |
| libexpat project | 1 |
| node-uuid | 1 |
| pkp | 1 |
| python software foundation | 1 |
| raspberry pi | 1 |
| red hat | 1 |
| siemens | 1 |
| silabs.com | 1 |
| sonatype | 1 |
