Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-522
Weakness type CWE-522 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 220 | 208 | 5 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▄▅▇█▅
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 1 · 2026-03 1 · 2026-04 1 · 2026-05 11 · 2026-06 22 · 2026-07 35 · 2026-08 47 · 2026-09 57 · 2026-10 32
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-29583 | 9.8 | 99.8 | KEV | Zyxel Multiple Products |
| CVE-2021-30116 | 9.8 | 99.7 | KEV | Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6 |
| CVE-2017-9248 | 9.8 | 99.5 | KEV | Progress ASP.NET AJAX and Sitefinity |
| CVE-2014-1812 | 8.8 | 99.2 | KEV | Microsoft Windows |
| CVE-2021-22681 | 9.8 | 99.2 | KEV | Rockwell Multiple Products |
| CVE-2019-10160 | 9.8 | 92.4 | — | — |
| CVE-2022-27776 | 6.5 | 90.6 | — | — |
| CVE-2021-42306 | 8.1 | 88.2 | — | Azure Active Directory Information Disclosure Vulnerability |
| CVE-2026-32315 | 5.5 | 86.9 | — | motionEye: World-Readable Configuration File Exposes Admin Password Hash |
| CVE-2026-54617 | 9.8 | 86.6 | — | GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler |
| CVE-2026-57219 | 8.7 | 86.4 | — | RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoi… |
| CVE-2022-27774 | 5.7 | 80.5 | — | — |
| CVE-2021-22923 | 5.3 | 80.5 | — | — |
| CVE-2025-26628 | 7.3 | 71.2 | — | Azure Local Cluster Information Disclosure Vulnerability |
| CVE-2026-62839 | 6.5 | 59.3 | — | Microsoft SharePoint Server Spoofing Vulnerability |
| CVE-2026-81381 | 7.5 | 58.2 | — | GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability |
| CVE-2026-47282 | 6.5 | 58.2 | — | GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability |
| CVE-2026-64918 | 6.5 | 58.2 | — | Microsoft Office Spoofing Vulnerability |
| CVE-2026-48295 | 7.5 | 56.9 | — | CAI Content Credentials | Insufficiently Protected Credentials (CWE-522) |
| CVE-2026-32171 | 8.8 | 55.0 | — | Azure Logic Apps Elevation of Privilege Vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 10 |
| asynchttpclient | 7 |
| ibm | 7 |
| apache | 5 |
| curl | 5 |
| mariadb-corporation | 5 |
| netcore | 5 |
| openclaw | 5 |
| cisco | 3 |
| flytohub | 3 |
| getgrav | 3 |
| gitlab | 3 |
| schneider electric | 3 |
| siyuan-note | 3 |
| sparklemotion | 3 |
