Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-345
Weakness type CWE-345 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 307 | 295 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▄▅██▆
2025-11 1 · 2025-12 1 · 2026-01 0 · 2026-02 2 · 2026-03 1 · 2026-04 0 · 2026-05 11 · 2026-06 30 · 2026-07 48 · 2026-08 76 · 2026-09 77 · 2026-10 50
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-38831 | 7.8 | 100.0 | KEV | RARLAB WinRAR |
| CVE-2022-26871 | 9.8 | 97.3 | KEV | Trend Micro Apex Central |
| CVE-2026-21527 | 6.5 | 94.8 | — | Microsoft Exchange Server Spoofing Vulnerability |
| CVE-2017-7674 | 4.3 | 94.7 | — | — |
| CVE-2026-85431 | 8.7 | 88.6 | — | MOOS essential-moos through 10.0.1 pMOOSBridge Unauthenticated UDP Packet Injection |
| CVE-2021-22947 | 5.9 | 87.2 | — | — |
| CVE-2023-51764 | 5.3 | 85.3 | — | — |
| CVE-2026-85430 | 8.8 | 76.3 | — | MOOS essential-moos through 10.0.1 pShare Unauthenticated UDP Datagram Republishing |
| CVE-2024-37370 | 7.5 | 54.0 | — | — |
| CVE-2026-28324 | 9.8 | 50.3 | — | SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability |
| CVE-2026-18674 | 7.0 | 45.3 | — | Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an un… |
| CVE-2026-71965 | 8.7 | 39.5 | — | CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature |
| CVE-2026-62869 | 8.8 | 37.0 | — | Azure Entra ID Spoofing Vulnerability |
| CVE-2026-85434 | 9.3 | 33.6 | — | MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping |
| CVE-2026-85435 | 9.3 | 33.6 | — | MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment |
| CVE-2025-27735 | 6.0 | 33.0 | — | Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability |
| CVE-2026-26007 | 8.2 | 31.4 | — | cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves |
| CVE-2026-18248 | 9.1 | 30.3 | — | @fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigate… |
| CVE-2026-44725 | 6.6 | 29.6 | — | EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code exe… |
| CVE-2026-47691 | 10.0 | 27.9 | — | Netty has Insufficient Bailiwick Validation for NS Records |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| red hat | 10 |
| apache | 7 |
| microsoft | 7 |
| better-auth | 5 |
| gitroomhq | 5 |
| jahlives | 5 |
| zcashfoundation | 5 |
| authlib | 4 |
| eclipse foundation | 4 |
| wwbn | 4 |
| arista networks | 3 |
| corewcf | 3 |
| jpadilla | 3 |
| legion of the bouncy castle | 3 |
| midnightbsd | 3 |
