Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-459
Weakness type CWE-459 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 79 | 62 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▇▆█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 0 · 2026-06 3 · 2026-07 2 · 2026-08 19 · 2026-09 16 · 2026-10 22
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2022-21123 | 5.5 | 94.0 | — | — |
| CVE-2022-21125 | 5.5 | 93.7 | — | — |
| CVE-2022-21166 | 5.5 | 93.7 | — | — |
| CVE-2022-1473 | 7.5 | 91.5 | — | Resource leakage when decoding certificates and keys |
| CVE-2023-42794 | 5.9 | 83.0 | — | Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows |
| CVE-2023-35945 | 7.5 | 76.2 | — | Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec |
| CVE-2026-52736 | 8.7 | 48.1 | — | ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache |
| CVE-2026-42492 | 7.5 | 48.1 | — | vIRQ event channel binding may break Xenstore |
| CVE-2026-77761 | 6.3 | 48.1 | — | Cross-Document Parser State Contamination in misp-stix |
| CVE-2026-87776 | 7.5 | 48.0 | — | compression vulnerable to Denial of Service via memory leak on premature response close |
| CVE-2021-47178 | 5.5 | 46.7 | — | scsi: target: core: Avoid smp_processor_id() in preemptible code |
| CVE-2026-88932 | 5.3 | 43.7 | — | multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads |
| CVE-2026-103937 | 8.7 | 41.6 | — | Misskey: Denial of service resulting from insufficient cleanup processing during file u… |
| CVE-2026-19474 | 7.5 | 41.0 | — | @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted u… |
| CVE-2026-19019 | 2.9 | 40.7 | — | poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence… |
| CVE-2026-5038 | 7.5 | 40.6 | — | multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads |
| CVE-2026-102030 | 8.7 | 38.5 | — | Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when… |
| CVE-2026-11576 | 7.5 | 38.5 | — | — |
| CVE-2026-85043 | 9.1 | 36.8 | — | — |
| CVE-2026-52733 | 6.5 | 36.4 | — | ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork … |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 17 | |
| linux | 8 |
| zcashfoundation | 4 |
| arista networks | 3 |
| multer | 3 |
| apache | 2 |
| filebrowser | 2 |
| misp | 2 |
| red hat | 2 |
| zephyrproject | 2 |
| @fastify/multipart | 1 |
| abb | 1 |
| ag-ui-protocol | 1 |
| aws | 1 |
| backdropcms | 1 |
