Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-436
Weakness type CWE-436 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 66 | 64 | 2 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▂▁▁▃▅█▇██
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 2 · 2026-03 0 · 2026-04 0 · 2026-05 3 · 2026-06 8 · 2026-07 13 · 2026-08 11 · 2026-09 14 · 2026-10 13
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-63030 | 9.8 | 95.8 | KEV | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to R… |
| CVE-2025-48384 | 8.0 | 91.2 | KEV | Git allows arbitrary code execution through broken config quoting |
| CVE-2024-2004 | 3.5 | 76.6 | — | Usage of disabled protocol |
| CVE-2026-25223 | 7.5 | 58.2 | — | Fastify's Content-Type header tab character allows body validation bypass |
| CVE-2026-17084 | 6.0 | 53.5 | — | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 |
| CVE-2026-47767 | 8.3 | 53.0 | — | Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV… |
| CVE-2026-40165 | 8.7 | 51.4 | — | authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifi… |
| CVE-2026-73614 | 8.7 | 51.4 | — | Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation |
| CVE-2026-6322 | 7.5 | 51.3 | — | fast-uri vulnerable to host confusion via percent-encoded authority delimiters |
| CVE-2026-18427 | 7.5 | 50.5 | — | @fastify/static vulnerable to route guard bypass via non-canonical path segments |
| CVE-2026-73615 | 8.7 | 50.3 | — | Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch |
| CVE-2026-56669 | 7.5 | 49.1 | — | Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict |
| CVE-2026-57580 | 9.4 | 47.1 | — | authentik: Account Takeover via SAML NameID Comment Truncation |
| CVE-2026-109429 | 8.7 | 45.5 | — | Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform |
| CVE-2026-81378 | 8.2 | 44.3 | — | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-67201 | 7.7 | 43.8 | — | V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http |
| CVE-2026-49332 | 8.5 | 43.6 | — | Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables ident… |
| CVE-2026-85184 | 9.1 | 43.1 | — | @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request t… |
| CVE-2026-14198 | 9.1 | 42.7 | — | @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter … |
| CVE-2026-109428 | 8.7 | 42.2 | — | Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| fast-uri | 7 |
| roocodeinc | 5 |
| jovancoding | 3 |
| @fastify/middie | 2 |
| corazawaf | 2 |
| envoyproxy | 2 |
| goauthentik | 2 |
| guzzle | 2 |
| kludex | 2 |
| mistralai | 2 |
| nodemailer | 2 |
| symfony | 2 |
| @backstage | 1 |
| @fastify/static | 1 |
| apache | 1 |
