Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-426
Weakness type CWE-426 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 101 | 83 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▂▁▁▁▁▁▁▁▁▁▂▁▁▁▁▂▂▁▂▂▆▅█▆▇
2025-11 0 · 2025-12 0 · 2026-01 2 · 2026-02 2 · 2026-03 1 · 2026-04 2 · 2026-05 3 · 2026-06 14 · 2026-07 11 · 2026-08 19 · 2026-09 13 · 2026-10 16
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2012-1854 | 7.8 | 97.5 | KEV | Microsoft Visual Basic for Applications (VBA) |
| CVE-2022-22047 | 7.8 | 97.3 | KEV | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
| CVE-2020-15801 | 9.8 | 89.4 | — | — |
| CVE-2018-16156 | 7.8 | 84.8 | — | — |
| CVE-2022-26488 | 7.0 | 73.8 | — | — |
| CVE-2024-30100 | 7.8 | 67.3 | — | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2019-5589 | 8.8 | 62.9 | — | — |
| CVE-2025-27743 | 7.8 | 58.5 | — | Microsoft System Center Elevation of Privilege Vulnerability |
| CVE-2020-9290 | 7.8 | 57.7 | — | — |
| CVE-2026-63093 | 8.7 | 57.3 | — | Cursor for Windows 3.2.16 RCE via Malicious git.exe in Workspace |
| CVE-2024-35260 | 9.8 | 56.7 | — | Microsoft Dataverse Remote Code Execution Vulnerability |
| CVE-2024-43616 | 7.8 | 54.9 | — | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2026-55769 | 9.4 | 54.8 | — | CloudNativePG: Overriding operators can lead to privilege escalation in CloudNativePG f… |
| CVE-2026-16674 | 8.8 | 54.0 | — | IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty |
| CVE-2026-45721 | 9.0 | 53.9 | — | Algernon: handler.lua discovery walks parent directories above the server root |
| CVE-2023-36898 | 7.8 | 53.0 | — | Tablet Windows User Interface Application Core Remote Code Execution Vulnerability |
| CVE-2026-74872 | 9.3 | 51.4 | — | openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool |
| CVE-2026-20943 | 7.0 | 49.9 | — | Microsoft Office Click-To-Run Remote Code Execution Vulnerability |
| CVE-2026-42830 | 6.5 | 49.8 | — | Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability |
| CVE-2024-3220 | 2.3 | 47.4 | — | Default mimetype known files writeable on Windows |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 23 |
| adobe | 11 |
| openclaw | 6 |
| ibm | 4 |
| fortinet | 3 |
| palo alto networks | 3 |
| aws | 2 |
| cloudnative-pg | 2 |
| jahlives | 2 |
| mechrevo | 2 |
| open-telemetry | 2 |
| @backstage | 1 |
| anysphere | 1 |
| apache | 1 |
| artifex software | 1 |
