Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-497
Weakness type CWE-497 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 126 | 121 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▅▇▄▆█
2025-11 1 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 4 · 2026-06 19 · 2026-07 28 · 2026-08 14 · 2026-09 23 · 2026-10 33
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-31955 | 5.5 | 99.6 | KEV | Windows Kernel Information Disclosure Vulnerability |
| CVE-2024-13999 | 7.3 | 79.1 | — | Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure |
| CVE-2025-34283 | 7.1 | 63.4 | — | Nagios XI < 2024R1.4.2 API Key Disclosure via Neptune Themes |
| CVE-2024-13998 | 6.0 | 63.4 | — | Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure |
| CVE-2026-71330 | 7.5 | 63.0 | — | Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability |
| CVE-2026-69723 | 5.7 | 58.8 | — | Windows Kernel Information Disclosure Vulnerability |
| CVE-2026-97740 | 6.5 | 56.9 | — | Microsoft Office Excel Information Disclosure Vulnerability |
| CVE-2026-14808 | 9.3 | 51.8 | — | PROG MIS｜Prog Management System - Exposure of Sensitive Information |
| CVE-2026-56124 | 8.7 | 49.5 | — | phpUploader < 2.0.2 Unauthenticated Database Exposure via index model |
| CVE-2018-25358 | 8.7 | 46.9 | — | D-Link DIR601 2.02NA Credential Disclosure via my_cgi.cgi |
| CVE-2025-46421 | 6.8 | 46.2 | — | Libsoup: information disclosure may leads libsoup client sends authorization header to … |
| CVE-2026-44945 | 9.1 | 45.4 | — | Cross-Cluster Impersonation Confused-Deputy Privilege Escalation |
| CVE-2026-27553 | 6.5 | 45.4 | — | Information Disclosure via Schema Path Manipulation |
| CVE-2026-81387 | 5.5 | 45.0 | — | Microsoft Excel Information Disclosure Vulnerability |
| CVE-2026-81394 | 5.5 | 45.0 | — | Microsoft Excel Information Disclosure Vulnerability |
| CVE-2026-75928 | 6.9 | 43.8 | — | Brushfire unauthenticated information disclosure |
| CVE-2026-69127 | 6.9 | 41.9 | — | Kirby: System path exposure from error messages in the REST API |
| CVE-2026-50294 | 6.2 | 41.9 | — | Windows Kernel Information Disclosure Vulnerability |
| CVE-2026-41928 | 6.9 | 41.5 | — | Vvveb < 1.0.8.2 Information Disclosure via Cron Controller |
| CVE-2026-69644 | 5.5 | 40.8 | — | Windows iSCSI Information Disclosure Vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 36 |
| red hat | 4 |
| sap_se | 4 |
| crocoblock | 3 |
| nagios | 3 |
| passmark software | 2 |
| pronetiqs | 2 |
| @quasar | 1 |
| ads wpquads | 1 |
| amd | 1 |
| areoi | 1 |
| arraytics | 1 |
| asus | 1 |
| bdthemes | 1 |
| bookingwp | 1 |
