Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-476
Weakness type CWE-476 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 1138 | 717 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▂▃▂▂▁▂▂▂▂▂▃▂▂▂▂▂▁▂▂▁▁▂▂▂▃▆█▇▆▆▆
2025-11 0 · 2025-12 1 · 2026-01 12 · 2026-02 10 · 2026-03 24 · 2026-04 30 · 2026-05 93 · 2026-06 135 · 2026-07 123 · 2026-08 87 · 2026-09 97 · 2026-10 106
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-21525 | 6.2 | 91.9 | KEV | Windows Remote Access Connection Manager Denial of Service Vulnerability |
| CVE-2025-22037 | 7.5 | 99.4 | — | ksmbd: fix null pointer dereference in alloc_preauth_hash() |
| CVE-2020-13934 | 7.5 | 99.2 | — | — |
| CVE-2021-3449 | 5.9 | 99.2 | — | NULL pointer deref in signature_algorithms processing |
| CVE-2020-1967 | 7.5 | 99.0 | — | Segmentation fault in SSL_check_chain |
| CVE-2019-5010 | 7.5 | 97.5 | — | — |
| CVE-2023-3866 | 5.5 | 96.2 | — | ksmbd: validate session id and tree id in the compound request |
| CVE-2021-36222 | 7.5 | 95.7 | — | — |
| CVE-2023-3338 | 6.5 | 95.0 | — | Crash due to a null pointer dereference in the dn_nsp_send function |
| CVE-2019-19926 | 7.5 | 94.7 | — | — |
| CVE-2019-19880 | 7.5 | 94.0 | — | — |
| CVE-2019-19923 | 7.5 | 93.9 | — | — |
| CVE-2026-77692 | 7.5 | 93.7 | — | Unauthenticated remote crash of named via a single DoH SIG(0) request |
| CVE-2019-9937 | 7.5 | 93.3 | — | — |
| CVE-2020-1069 | 8.8 | 90.4 | — | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2020-24659 | 7.5 | 90.0 | — | — |
| CVE-2018-14404 | 6.5 | 89.7 | — | — |
| CVE-2020-9327 | 7.5 | 89.7 | — | — |
| CVE-2021-38604 | 7.5 | 89.7 | — | — |
| CVE-2021-3537 | 5.9 | 89.3 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| linux | 584 |
| microsoft | 56 |
| red hat | 30 |
| adobe | 29 |
| juniper networks | 19 |
| gnu | 15 |
| openssl | 14 |
| zephyrproject | 13 |
| ibm | 12 |
| freerdp | 11 |
| qnap systems | 9 |
| mongodb | 8 |
| nvidia | 8 |
| wireshark foundation | 7 |
| apache | 6 |
