Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-611
Weakness type CWE-611 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 139 | 121 | 8 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▄▄▅█▄
2025-11 1 · 2025-12 2 · 2026-01 2 · 2026-02 0 · 2026-03 1 · 2026-04 4 · 2026-05 6 · 2026-06 15 · 2026-07 16 · 2026-08 20 · 2026-09 40 · 2026-10 17
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-34102 | 9.8 | 100.0 | KEV | XXE can expose crypt key and other secrets granting full admin access |
| CVE-2019-9670 | 9.8 | 100.0 | KEV | Synacor Zimbra Collaboration Suite (ZCS) |
| CVE-2025-2776 | 9.3 | 99.2 | KEV | SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection |
| CVE-2025-58360 | 9.8 | 99.1 | KEV | GeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WM… |
| CVE-2025-2775 | 9.3 | 98.7 | KEV | SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection |
| CVE-2019-13608 | 7.5 | 98.2 | KEV | Citrix StoreFront Server |
| CVE-2016-9563 | 6.5 | 97.8 | KEV | SAP NetWeaver |
| CVE-2023-45727 | 7.5 | 89.1 | KEV | North Grid Proself |
| CVE-2025-68493 | 8.1 | 98.8 | — | Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component |
| CVE-2013-0340 | 6.8 | 97.3 | — | — |
| CVE-2020-25649 | 7.5 | 97.1 | — | — |
| CVE-2017-9233 | 7.5 | 95.1 | — | — |
| CVE-2018-14720 | 9.8 | 94.4 | — | — |
| CVE-2018-20843 | 7.5 | 94.2 | — | — |
| CVE-2017-7375 | 9.8 | 87.1 | — | — |
| CVE-2016-9318 | 5.5 | 86.9 | — | — |
| CVE-2026-26171 | 7.5 | 82.7 | — | .NET Denial of Service Vulnerability |
| CVE-2026-48359 | 9.6 | 62.3 | — | Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE'… |
| CVE-2026-40682 | 9.1 | 57.2 | — | Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor |
| CVE-2026-47960 | 7.4 | 57.0 | — | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 25 |
| apache | 12 |
| adobe | 6 |
| cisco | 3 |
| dell | 3 |
| eclipse foundation | 3 |
| jetbrains | 3 |
| verapdf | 3 |
| docling-project | 2 |
| geoserver | 2 |
| microsoft | 2 |
| nextgen healthcare | 2 |
| progress | 2 |
| red hat | 2 |
| rti | 2 |
