Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-494
Weakness type CWE-494 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 59 | 56 | 4 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▂▃▂▇█▆
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 1 · 2026-03 2 · 2026-04 0 · 2026-05 3 · 2026-06 5 · 2026-07 2 · 2026-08 14 · 2026-09 16 · 2026-10 12
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2022-40799 | 8.8 | 98.4 | KEV | D-Link DNR-322L |
| CVE-2025-15556 | 7.7 | 77.8 | KEV | Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verification |
| CVE-2021-44168 | 3.3 | 58.0 | KEV | Fortinet FortiOS |
| CVE-2026-3502 | 7.8 | 24.5 | KEV | TrueConf Client Update Integrity Verification Bypass |
| CVE-2020-5398 | 7.5 | 99.8 | — | RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or… |
| CVE-2026-85427 | 9.2 | 45.0 | — | MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MI… |
| CVE-2025-69263 | 8.8 | 39.7 | — | pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies |
| CVE-2026-30612 | 9.8 | 34.5 | — | — |
| CVE-2026-65081 | 9.8 | 33.9 | — | — |
| CVE-2026-48046 | 9.3 | 27.8 | — | Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC H… |
| CVE-2026-66398 | 9.4 | 26.4 | — | phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API |
| CVE-2026-82021 | 9.0 | 25.8 | — | Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference |
| CVE-2026-59286 | 8.1 | 24.4 | — | Spring for GraphQL loads Untrusted Resources in GraphiQL support |
| CVE-2026-65097 | 8.8 | 23.0 | — | — |
| CVE-2026-63696 | 9.1 | 21.5 | — | — |
| CVE-2026-45058 | 9.4 | 21.1 | — | electerm: Import unsafe bookmark data could lead to unsafe operation when click local t… |
| CVE-2026-55698 | 8.8 | 21.0 | — | pnpm: Project env lockfile can short-circuit package-manager resolution and execute loc… |
| CVE-2026-92128 | 7.5 | 20.5 | — | — |
| CVE-2026-79963 | 7.4 | 17.7 | — | — |
| CVE-2026-9037 | 9.3 | 17.4 | — | Download of code without integrity check in XCharge C6 |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| dell | 4 |
| jenkins project | 3 |
| pnpm | 3 |
| mitel | 2 |
| nvidia | 2 |
| parse-community | 2 |
| spring | 2 |
| 0xjacky | 1 |
| angular | 1 |
| anthropics | 1 |
| asus | 1 |
| connectwise | 1 |
| eclipse foundation | 1 |
| eidetic-labs | 1 |
| electerm | 1 |
