Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-405
Weakness type CWE-405 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 28 | 28 | 0 |
Monthly trend
▂▃▁▃▄█
2026-05 1 · 2026-06 3 · 2026-07 0 · 2026-08 4 · 2026-09 6 · 2026-10 14
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-47774 | 7.5 | 63.7 | — | Envoy vulnerable to HTTP/2 memory exhaustion via cookie header size bypass and HPACK am… |
| CVE-2026-96960 | 7.5 | 63.2 | — | .NET Denial of Service Vulnerability |
| CVE-2026-104712 | 7.5 | 60.5 | — | Apache Struts: Disproportionate response size when rendering BigDecimal request parameters |
| CVE-2026-72914 | 7.5 | 56.7 | — | Mastodon: Exhausting data by an unauthenticated request to the admin retention API |
| CVE-2026-70162 | 5.9 | 54.7 | — | .NET Denial of Service Vulnerability |
| CVE-2026-87011 | 7.5 | 49.8 | — | Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in … |
| CVE-2026-54874 | 7.5 | 48.7 | — | Excessive Memory Use Buffering DTLS Records for a Future Epoch |
| CVE-2026-78659 | 7.5 | 46.0 | — | HTTP/2 server memory exhaustion due to Trailer headers in net/http |
| CVE-2026-78669 | 7.5 | 45.9 | — | Excessive CPU consumption from repeated initial window changes in net/http |
| CVE-2026-103880 | 7.5 | 40.6 | — | Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored… |
| CVE-2026-75029 | 5.3 | 40.0 | — | Message parser retains every identical singleton RDATA, enabling wire-to-work amplifica… |
| CVE-2026-68531 | 2.1 | 38.8 | — | Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped… |
| CVE-2026-104817 | 8.7 | 38.4 | — | Misskey: Lack of rate limiting and size restrictions in RSS fetching API |
| CVE-2026-86432 | 6.9 | 34.6 | — | commonmark 2.0.0 before 2.8.4 Denial of Service via XML |
| CVE-2026-23930 | 5.3 | 33.0 | — | Frontend DoS via the popup.testtriggerexpr action |
| CVE-2026-54224 | 7.1 | 32.4 | — | Denial of Service in UBB.threads |
| CVE-2026-97031 | 7.5 | 32.0 | — | Reject malformed ECH outer extension references in crypto/tls |
| CVE-2025-32394 | 5.3 | 30.6 | — | AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock |
| CVE-2026-82309 | 4.3 | 29.7 | — | Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DN… |
| CVE-2026-23934 | 5.1 | 27.7 | — | Frontend DoS via the validate.api.exists action |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| go standard library | 3 |
| zcashfoundation | 3 |
| apache | 2 |
| golang.org/x/net | 2 |
| microsoft | 2 |
| zabbix | 2 |
| concrete cms | 1 |
| envoyproxy | 1 |
| ibm | 1 |
| isc | 1 |
| mastodon | 1 |
| misskey-dev | 1 |
| nezumi | 1 |
| open-webui | 1 |
| openssl | 1 |
