Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-472
Weakness type CWE-472 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 75 | 74 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▄█▄▃▃▄
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 11 · 2026-06 28 · 2026-07 10 · 2026-08 6 · 2026-09 8 · 2026-10 11
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-35939 | 6.9 | 71.0 | KEV | Craft CMS stores user-provided content in session files |
| CVE-2026-65052 | 8.7 | 46.6 | — | Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in Lis… |
| CVE-2026-67363 | 7.7 | 45.2 | — | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2… |
| CVE-2026-107363 | 6.1 | 38.1 | — | — |
| CVE-2026-77470 | 8.3 | 37.8 | — | Lychee: Webshop checkout lets the client override the payment `amount` sent to the gate… |
| CVE-2026-77999 | 8.7 | 35.6 | — | Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to … |
| CVE-2026-82189 | 8.7 | 35.6 | — | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store… |
| CVE-2026-14430 | 8.8 | 34.1 | — | — |
| CVE-2026-59817 | 5.3 | 33.0 | — | Ghost: Paid gift memberships obtainable at minimal cost via the donations feature |
| CVE-2026-56877 | 6.3 | 31.9 | — | — |
| CVE-2026-13841 | 8.3 | 31.3 | — | — |
| CVE-2026-9968 | 8.8 | 30.7 | — | — |
| CVE-2026-10524 | 7.5 | 30.6 | — | CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation |
| CVE-2026-94374 | 8.3 | 29.6 | — | MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparentin… |
| CVE-2025-59382 | 1.2 | 29.2 | — | QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances) |
| CVE-2026-16620 | 7.5 | 28.9 | — | WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Se… |
| CVE-2026-10963 | 8.8 | 28.3 | — | — |
| CVE-2026-10964 | 8.8 | 28.3 | — | — |
| CVE-2026-10965 | 8.8 | 28.3 | — | — |
| CVE-2026-10987 | 8.8 | 28.3 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 41 | |
| j2commerce.com | 2 |
| abis technology ltd. co | 1 |
| balbooa.com | 1 |
| craft | 1 |
| ec-cube co.,ltd | 1 |
| invoiceshelf | 1 |
| jenkins project | 1 |
| lycheeorg | 1 |
| mattermost | 1 |
| misp | 1 |
| mohammadr3z | 1 |
| openstack | 1 |
| ph7software | 1 |
| qnap systems | 1 |
