Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-35
Weakness type CWE-35 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 33 | 32 | 1 |
Monthly trend
▂▁▁▁▁▂▁▁▁▄▇▄█▇▇
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 3 · 2026-06 6 · 2026-07 3 · 2026-08 7 · 2026-09 6 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-8088 | 8.4 | 99.9 | KEV | Path traversal vulnerability in WinRAR |
| CVE-2025-68428 | 9.2 | 82.0 | — | jsPDF has Local File Inclusion/Path Traversal vulnerability |
| CVE-2026-59115 | 9.9 | 62.9 | — | Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability |
| CVE-2026-45495 | 9.8 | 61.8 | — | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-45661 | 9.9 | 56.3 | — | Dokploy: Remote Code Execution through Path Traversal |
| CVE-2026-13716 | 9.1 | 55.8 | — | Path Traversal: '.../...//' in Crafty Controller |
| CVE-2026-27557 | 7.5 | 52.6 | — | Path Traversal in /index.php/view_uploaded_iodd_file |
| CVE-2026-40128 | 9.0 | 49.0 | — | Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) |
| CVE-2026-69109 | 8.7 | 48.8 | — | — |
| CVE-2026-42661 | 8.8 | 44.7 | — | WordPress WP Customer Area plugin <= 8.3.4 - Path Traversal vulnerability |
| CVE-2026-52707 | 8.1 | 43.3 | — | WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability |
| CVE-2026-49112 | 7.5 | 41.7 | — | WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability |
| CVE-2026-52703 | 9.6 | 41.4 | — | WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability |
| CVE-2026-44415 | 8.9 | 38.6 | — | — |
| CVE-2026-44414 | 6.9 | 37.9 | — | — |
| CVE-2026-49779 | 6.5 | 37.0 | — | WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability |
| CVE-2026-85310 | 6.5 | 37.0 | — | WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability |
| CVE-2025-59181 | 4.8 | 35.9 | — | Path traversal Vulnerability |
| CVE-2026-28157 | 7.5 | 33.6 | — | WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability |
| CVE-2026-66695 | 6.5 | 33.4 | — | WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| siemens | 3 |
| dell | 2 |
| microsoft | 2 |
| samsung mobile | 2 |
| sap_se | 2 |
| tryghost | 2 |
| addify | 1 |
| adrian tobey | 1 |
| aguilatechnologies | 1 |
| arcadia technology | 1 |
| boldgrid | 1 |
| carlo gavazzi automation | 1 |
| dokploy | 1 |
| ericsson | 1 |
| hitachi industrial equipment systems | 1 |
