Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-601
Weakness type CWE-601 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 332 | 319 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▆█▅▇▄
2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 0 · 2026-03 1 · 2026-04 3 · 2026-05 15 · 2026-06 58 · 2026-07 84 · 2026-08 52 · 2026-09 67 · 2026-10 38
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-38000 | 6.1 | 92.1 | KEV | Google Chromium Intents |
| CVE-2012-0518 | 4.7 | 91.7 | KEV | Oracle Fusion Middleware |
| CVE-2018-11784 | 4.3 | 99.9 | — | — |
| CVE-2024-8883 | 6.1 | 81.5 | — | Keycloak: vulnerable redirect uri validation results in open redirec |
| CVE-2020-1059 | 4.3 | 81.5 | — | Microsoft Edge Spoofing Vulnerability |
| CVE-2022-0235 | 6.1 | 76.2 | — | Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch |
| CVE-2023-6927 | 6.1 | 65.3 | — | Keycloak: open redirect via "form_post.jwt" jarm response mode |
| CVE-2021-31879 | 6.1 | 65.2 | — | — |
| CVE-2023-6291 | 7.1 | 60.6 | — | Keycloak: redirect_uri validation bypass |
| CVE-2026-103576 | 6.5 | 54.9 | — | Active Directory Federation Services (AD FS) Spoofing Vulnerability |
| CVE-2026-40961 | 7.2 | 54.4 | — | Apache Airflow: Open Redirect Bypass Vulnerability |
| CVE-2026-47645 | 8.8 | 54.3 | — | Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability |
| CVE-2026-33102 | 9.3 | 52.9 | — | Microsoft 365 Copilot Elevation of Privilege Vulnerability |
| CVE-2026-41106 | 9.3 | 52.9 | — | Microsoft 365 Copilot Elevation of Privilege Vulnerability |
| CVE-2026-14902 | 6.1 | 52.4 | — | — |
| CVE-2026-53437 | 4.3 | 51.6 | — | — |
| CVE-2025-14524 | 5.3 | 51.5 | — | bearer token leak on cross-protocol redirect |
| CVE-2026-67178 | 7.8 | 50.7 | — | Open Redirect in MISP Installer-Generated Apache Configuration |
| CVE-2026-51564 | 4.9 | 50.3 | — | — |
| CVE-2026-53573 | 4.8 | 50.0 | — | core-geonetwork has an Open Redirect Bypass |
