Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-390
Weakness type CWE-390 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 13 | 11 | 0 |
Monthly trend
▃▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▅▃▁▆█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 1 · 2026-06 2 · 2026-07 1 · 2026-08 0 · 2026-09 3 · 2026-10 4
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-26465 | 6.8 | 94.6 | — | Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled |
| CVE-2024-12086 | 6.8 | 78.5 | — | Rsync: rsync server leaks arbitrary client files |
| CVE-2026-53434 | 9.1 | 46.9 | — | Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector |
| CVE-2026-85716 | 3.7 | 33.6 | — | AsyncHttpClient: SCRAM and Digest mutual-authentication responses are not verified |
| CVE-2026-104480 | 9.4 | 32.4 | — | Improper MLS Welcome roster validation in Discord libdave allows unauthorized group mem… |
| CVE-2026-111823 | 9.8 | 29.5 | — | — |
| CVE-2026-52989 | 9.8 | 27.8 | — | nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers |
| CVE-2026-107275 | 6.8 | 22.6 | — | @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed |
| CVE-2026-29810 | 4.3 | 22.2 | — | — |
| CVE-2026-104002 | 6.0 | 21.9 | — | Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) |
| CVE-2026-76642 | 8.5 | 11.2 | — | util-linux libmount Privilege Escalation via Failed Mount Helper |
| CVE-2026-48792 | 4.4 | 6.8 | — | pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote des… |
| CVE-2026-59845 | 5.9 | 1.0 | — | Libssh: libssh: denial of service via unchecked proxycommand fork() failure |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| red hat | 3 |
| @fastify/jwt | 1 |
| apache | 1 |
| asynchttpclient | 1 |
| aws | 1 |
| cyberpanel | 1 |
| discord | 1 |
| linux | 1 |
| mage | 1 |
| mcdope | 1 |
| util-linux | 1 |
