Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-358
Weakness type CWE-358 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 28 | 23 | 1 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▂▁▂▁▁▁▁▁▁▁█▅▅▁▂▃
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 9 · 2026-06 5 · 2026-07 5 · 2026-08 0 · 2026-09 1 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-7965 | 8.8 | 97.2 | KEV | Google Chromium V8 |
| CVE-2018-1270 | 9.8 | 99.6 | — | — |
| CVE-2026-50628 | 9.8 | 62.9 | — | Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control |
| CVE-2026-44513 | 8.8 | 58.7 | — | Diffusers: `trust_remote_code` bypass via `custom_pipeline` and local custom components |
| CVE-2026-70174 | 8.8 | 56.0 | — | .NET Remote Code Execution Vulnerability |
| CVE-2026-45109 | 7.5 | 54.5 | — | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
| CVE-2023-4501 | 9.8 | 54.3 | — | Authentication bypass in OpenText (Micro Focus) Enterprise Server |
| CVE-2026-96303 | 6.5 | 47.9 | — | Microsoft PowerShell Security Feature Bypass Vulnerability |
| CVE-2026-85805 | 6.5 | 47.2 | — | Microsoft PowerShell Security Feature Bypass Vulnerability |
| CVE-2026-40597 | 7.6 | 46.9 | — | MantisBT has a Content Security Policy bypass via attachments |
| CVE-2026-48797 | 9.3 | 45.9 | — | Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication |
| CVE-2026-57915 | 7.3 | 43.3 | — | Apache Kerby: Kerberos Pre-Authentication Bypass |
| CVE-2026-12577 | 8.7 | 35.6 | — | DVP80ES3 Improperly Implemented Security Check for Standard vulnerability |
| CVE-2024-55599 | 4.9 | 32.6 | — | — |
| CVE-2026-65058 | 5.9 | 32.5 | — | Trezor Safe improper security check in on-device display |
| CVE-2025-10457 | 8.1 | 32.3 | — | Bluetooth: Out-Of-Context le_conn_rsp Handling |
| CVE-2026-49783 | 7.8 | 25.1 | — | Secure Boot Security Feature Bypass Vulnerability |
| CVE-2026-96760 | 9.8 | 18.9 | — | Authlib library contains a signature‑verification bypass vulnerability |
| CVE-2026-44473 | 7.1 | 17.8 | — | Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse |
| CVE-2026-42081 | 7.1 | 17.5 | — | free5GC: UE Security Capability bypass on NGAP PathSwitchRequest |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 4 |
| ellanetworks | 3 |
| 3 | |
| apache | 2 |
| free5gc | 2 |
| apple | 1 |
| authlib | 1 |
| deltaww | 1 |
| fortinet | 1 |
| huggingface | 1 |
| mantisbt | 1 |
| mcp-tool-shop-org | 1 |
| nlnet labs | 1 |
| openidc | 1 |
| opentext | 1 |
