Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-407
Weakness type CWE-407 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 168 | 161 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▄▄▅██
2025-11 1 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 0 · 2026-04 2 · 2026-05 7 · 2026-06 19 · 2026-07 21 · 2026-08 23 · 2026-09 45 · 2026-10 43
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-43485 | 7.5 | 87.5 | — | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43484 | 7.5 | 87.0 | — | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43483 | 7.5 | 86.7 | — | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2022-45061 | 7.5 | 85.5 | — | — |
| CVE-2024-12243 | 5.3 | 69.8 | — | Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos |
| CVE-2024-12133 | 5.3 | 65.4 | — | Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos |
| CVE-2026-69651 | 7.5 | 65.2 | — | .NET Denial of Service Vulnerability |
| CVE-2026-96958 | 7.5 | 63.3 | — | .NET Denial of Service Vulnerability |
| CVE-2026-55968 | 8.7 | 63.1 | — | Apache Thrift: Node.js quadratic-time DoS in server receive transports |
| CVE-2026-54892 | 8.7 | 60.6 | — | Plug: quadratic-time decoding of nested query/body parameters enables denial of service |
| CVE-2026-49329 | 7.5 | 58.0 | — | Openshift/oauth-server: openshift/oauth-server: quadratic-time dos via accept-language … |
| CVE-2026-41292 | 6.6 | 56.7 | — | Long list of incoming EDNS options degrades performance |
| CVE-2026-68750 | 8.2 | 55.9 | — | Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exh… |
| CVE-2026-70196 | 5.9 | 55.9 | — | ASP.NET Core Denial of Service Vulnerability |
| CVE-2026-59094 | 8.7 | 55.6 | — | Pathway - Unauthenticated Denial of Service via Exponential Glob Pattern Matching in Do… |
| CVE-2026-85446 | 8.7 | 55.2 | — | MOOS-IvP through 24.8.1 uFldNodeComms Quadratic Processing Denial of Service |
| CVE-2026-84008 | 7.5 | 54.7 | — | .NET Denial of Service Vulnerability |
| CVE-2026-66046 | 8.7 | 53.9 | — | Expat Denial of Service via storeAtts() Quadratic Complexity |
| CVE-2026-71321 | 7.5 | 53.8 | — | Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body … |
| CVE-2026-75005 | 8.7 | 53.8 | — | Apache APISIX: Unauthenticated CPU-exhaustion DoS |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 8 |
| progressive robot | 8 |
| thephpleague | 8 |
| microsoft | 7 |
| nodeca | 6 |
| red hat | 6 |
| py-pdf | 5 |
| lepture | 4 |
| oisf | 4 |
| andialbrecht | 3 |
| libexpat project | 3 |
| markdown-it | 3 |
| messagepack-csharp | 3 |
| nlnet labs | 3 |
| ow2 | 3 |
