Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-602
Weakness type CWE-602 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 75 | 73 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁█▄▃▃▂
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 1 · 2026-06 35 · 2026-07 15 · 2026-08 10 · 2026-09 9 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-42787 | 6.5 | 77.4 | — | — |
| CVE-2026-72867 | 9.9 | 60.7 | — | Dokploy: Incomplete fix of CVE-2026-45628: Command Injection via Unvalidated Branch Fie… |
| CVE-2026-42266 | 8.8 | 57.5 | — | JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (mali… |
| CVE-2026-54104 | 8.7 | 53.1 | — | U.S. GAO EPDS and CBCA EDS client-based privilege escalation |
| CVE-2026-45274 | 6.9 | 52.5 | — | MyBooks: Unauthenticated Registration Bypass via Missing Server-Side ALLOW_REGISTER Enf… |
| CVE-2026-73267 | 7.7 | 49.0 | — | Clusterclaims-controller: managedcluster deletion keyed solely on clusterclaim.spec.nam… |
| CVE-2025-4527 | 2.9 | 48.6 | — | Dígitro NGC Explorer Password Transmission client-side enforcement of server-side security |
| CVE-2026-63301 | 7.0 | 46.3 | — | Denial of Service in Quick.CMS |
| CVE-2026-67363 | 7.7 | 45.2 | — | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2… |
| CVE-2026-89175 | 6.9 | 44.3 | — | Kingdom Communication Associated｜Smart Video Intercom System - Client-Side Authentication |
| CVE-2026-84841 | 5.5 | 44.2 | — | tsi-coop tsi-dpdp-cms client-side enforcement of server-side security |
| CVE-2026-64813 | 10.0 | 43.0 | — | — |
| CVE-2026-65051 | 6.9 | 40.8 | — | Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in… |
| CVE-2026-84110 | 5.5 | 40.6 | — | Releasit Releasit COD Form & Upsells OTP Validation client-side enforcement of server-s… |
| CVE-2026-77026 | 6.9 | 38.0 | — | Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms ext… |
| CVE-2026-77999 | 8.7 | 35.6 | — | Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to … |
| CVE-2026-82189 | 8.7 | 35.6 | — | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store… |
| CVE-2026-59504 | 9.1 | 35.5 | — | Priority – CWE-602: Client-Side Enforcement of Server-Side Security |
| CVE-2026-73627 | 6.0 | 35.0 | — | JupyterLab 4.6.0 Plugin Manager Lock-Rule Enforcement Bypass |
| CVE-2026-46485 | 8.2 | 34.8 | — | Dash: Users can write to config despire permissions (OIDC tested) |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 38 | |
| ibm | 2 |
| j2commerce.com | 2 |
| johnson & johnson | 2 |
| jupyterlab | 2 |
| siemens | 2 |
| balbooa.com | 1 |
| capgo | 1 |
| civilian board of contract appeals | 1 |
| dfir-iris | 1 |
| divasoft software and e-commerce | 1 |
| dokploy | 1 |
| dígitro | 1 |
| fortinet | 1 |
| gobito informatics technologies engineering industry and trade ltd. co | 1 |
