Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-489
Weakness type CWE-489 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 29 | 28 | 0 |
Monthly trend
▂▁▁▁▁▁▂▃▂█▄█▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 2 · 2026-06 1 · 2026-07 8 · 2026-08 3 · 2026-09 8 · 2026-10 5
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-9133 | 8.3 | 64.7 | — | Arbitrary file read in rabbitmq-aws plugin |
| CVE-2026-40035 | 9.3 | 53.1 | — | Unfurl - Werkzeug Debugger Exposure via String Config Parsing |
| CVE-2026-13313 | 8.9 | 51.7 | — | — |
| CVE-2026-41186 | 6.0 | 50.9 | — | Unauthenticated Go pprof exposure in Calico debug server |
| CVE-2026-59092 | 7.0 | 50.5 | — | JuiceFS - Authentication Bypass via pprof and metrics Endpoints |
| CVE-2026-49188 | 8.7 | 49.1 | — | Elevated Root Command Execution via ai_cmd Sockets |
| CVE-2026-58191 | 6.1 | 45.8 | — | Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes |
| CVE-2026-53952 | 9.8 | 45.1 | — | GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setu… |
| CVE-2026-84486 | 8.2 | 43.3 | — | Automation-controller: automation-controller-container: automation-controller: unauthen… |
| CVE-2026-66405 | 8.7 | 42.2 | — | — |
| CVE-2026-58378 | 8.6 | 37.0 | — | Allwinner TV Box TV98 ADB exposed on network |
| CVE-2026-66403 | 8.7 | 36.1 | — | — |
| CVE-2026-45728 | 7.5 | 34.5 | — | Algernon: Single-file mode unconditionally enables debug mode |
| CVE-2026-54798 | 7.1 | 33.9 | — | — |
| CVE-2026-103475 | 9.3 | 32.4 | — | yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure |
| CVE-2026-77545 | 9.0 | 31.9 | — | — |
| CVE-2026-100102 | 9.5 | 27.9 | — | RCE via exposed JDWP debug agent in P4Search |
| CVE-2026-102628 | 9.2 | 25.4 | — | Cadmos LTI exposure of sensitive information via debug mode |
| CVE-2025-4106 | 8.9 | 23.8 | — | WatchGuard Firebox leftover debug code vulnerability |
| CVE-2026-65893 | 7.0 | 12.6 | — | Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| acer | 2 |
| ecovacs robotics | 2 |
| red hat | 2 |
| siemens | 2 |
| allwinner | 1 |
| anjvision | 1 |
| appium | 1 |
| asus | 1 |
| aws | 1 |
| cp-plus | 1 |
| dell | 1 |
| eummena | 1 |
| getsimplecms | 1 |
| getsimplecms-ce | 1 |
| insyde software | 1 |
