Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-425
Weakness type CWE-425 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 29 | 26 | 2 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▄▁▂█▄███
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 0 · 2026-03 2 · 2026-04 0 · 2026-05 1 · 2026-06 5 · 2026-07 2 · 2026-08 5 · 2026-09 5 · 2026-10 5
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-45195 | 9.8 | 100.0 | KEV | Apache OFBiz: Confused controller-view authorization logic (forced browsing) |
| CVE-2021-26085 | 5.3 | 100.0 | KEV | Atlassian Confluence Server |
| CVE-2026-0650 | 9.3 | 74.2 | — | OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization |
| CVE-2026-25679 | 7.5 | 56.9 | — | Incorrect parsing of IPv6 host literals in net/url |
| CVE-2026-10521 | 8.6 | 44.9 | — | Authenticated unintended access to critical program parameters |
| CVE-2026-19903 | 5.5 | 43.8 | — | SourceCodester Online Clothing Store SQL Database Backup shopping.sql file access |
| CVE-2026-76799 | 5.5 | 43.8 | — | code-projects Login Registration System SQL Database Backup login_registration_system.s… |
| CVE-2026-78051 | 5.5 | 43.8 | — | alexta69 MeTube Cookie File cookies.txt file access |
| CVE-2026-13533 | 5.5 | 40.3 | — | agentejo Cockpit CMS htaccess config.yaml YAMLLoad file access |
| CVE-2026-34028 | 6.9 | 39.6 | — | Unauthenticated direct access to web data in Wertheim SafeController Software exposes f… |
| CVE-2023-4018 | 4.3 | 38.9 | — | Direct Request ('Forced Browsing') in GitLab |
| CVE-2026-40532 | 6.5 | 35.1 | — | — |
| CVE-2026-60011 | 6.9 | 32.5 | — | — |
| CVE-2026-87744 | 9.1 | 31.3 | — | Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus re… |
| CVE-2026-33217 | 6.5 | 29.1 | — | NATS allows MQTT clients to bypass ACL checks |
| CVE-2026-8205 | 6.3 | 27.5 | — | Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in Calendar Block si… |
| CVE-2026-14953 | 5.3 | 24.6 | — | Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to impro… |
| CVE-2026-108938 | 5.5 | 22.6 | — | code-projects Matrimonial System matrimony.sql file access |
| CVE-2026-11986 | 4.9 | 21.4 | — | Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk… |
| CVE-2026-36453 | 7.4 | 18.1 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| code-projects | 2 |
| hclsoftware | 2 |
| red hat | 2 |
| agentejo | 1 |
| alexta69 | 1 |
| apache | 1 |
| atlassian | 1 |
| comelit group s.p.a | 1 |
| concrete cms | 1 |
| frauscher sensortechnik | 1 |
| gitlab | 1 |
| go standard library | 1 |
| ibm | 1 |
| kentico | 1 |
| mb connect line | 1 |
