Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-352
Weakness type CWE-352 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 675 | 656 | 6 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▅▇█▇█▅
2025-11 1 · 2025-12 6 · 2026-01 2 · 2026-02 2 · 2026-03 6 · 2026-04 4 · 2026-05 77 · 2026-06 111 · 2026-07 131 · 2026-08 117 · 2026-09 135 · 2026-10 71
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2016-6277 | 8.8 | 100.0 | KEV | NETGEAR Multiple Routers |
| CVE-2025-62593 | 9.4 | 99.2 | KEV | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack |
| CVE-2014-100005 | 8.0 | 98.7 | KEV | D-Link DIR-600 Router |
| CVE-2008-4128 | 8.1 | 98.4 | KEV | Cisco IOS |
| CVE-2023-2533 | 8.4 | 98.1 | KEV | PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF |
| CVE-2020-10181 | 9.8 | 96.6 | KEV | Sumavision Enhanced Multimedia Router (EMR) |
| CVE-2015-5351 | 8.8 | 95.5 | — | — |
| CVE-2020-1103 | 6.5 | 82.3 | — | Microsoft SharePoint Information Disclosure Vulnerability |
| CVE-2026-75743 | 7.1 | 73.7 | — | Adobe Experience Manager Forms JEE | Cross-Site Request Forgery (CSRF) (CWE-352) |
| CVE-2021-41372 | 7.6 | 51.5 | — | Power BI Report Server Spoofing Vulnerability |
| CVE-2026-8174 | 5.7 | 51.4 | — | Cross-site Request Forgery |
| CVE-2026-19650 | 7.1 | 48.4 | — | Cross-Site Request Forgery (CSRF) in GitLab |
| CVE-2026-56660 | 9.1 | 43.5 | — | GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction |
| CVE-2026-14620 | 4.7 | 43.0 | — | webpack-dev-server vulnerable to cross-site request forgery via internal developer endp… |
| CVE-2026-60009 | 8.8 | 37.2 | — | — |
| CVE-2024-21381 | 6.8 | 34.9 | — | Microsoft Azure Active Directory B2C Spoofing Vulnerability |
| CVE-2026-15070 | 8.8 | 32.7 | — | Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution … |
| CVE-2025-12821 | 8.8 | 32.6 | — | NewsBlogger <= 0.2.5.6 - 0.2.5.9 - Cross-Site Request Forgery to Arbitrary Plugin Insta… |
| CVE-2026-44613 | 6.1 | 31.2 | — | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling |
| CVE-2026-71694 | 8.8 | 30.6 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| oracle | 43 |
| concrete cms | 31 |
| 28 | |
| wwbn | 19 |
| jenkins project | 13 |
| misp | 11 |
| ibm | 10 |
| cotonti | 9 |
| apache | 7 |
| regularlabs.com | 7 |
| admidio | 6 |
| sourcecodester | 6 |
| yeswiki | 6 |
| joomshaper.com | 5 |
| mybb | 5 |
