Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-613
Weakness type CWE-613 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 160 | 153 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▅▆▅█▆
2025-11 0 · 2025-12 1 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 0 · 2026-05 5 · 2026-06 25 · 2026-07 27 · 2026-08 22 · 2026-09 41 · 2026-10 32
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2013-0335 | 7.6 | 81.7 | — | Openstack nova: vnc proxy can connect to the wrong vm |
| CVE-2024-50562 | 4.4 | 66.6 | — | — |
| CVE-2024-13996 | 9.2 | 63.9 | — | Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change |
| CVE-2026-82310 | 7.2 | 62.3 | — | Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core … |
| CVE-2026-82311 | 9.8 | 61.5 | — | Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int … |
| CVE-2026-86533 | 9.1 | 59.2 | — | Revoked session accepted because the session jti is never checked in AshAuthentication … |
| CVE-2026-55250 | 8.7 | 58.0 | — | Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Ta… |
| CVE-2026-86462 | 9.1 | 56.7 | — | Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-back… |
| CVE-2026-86473 | 9.1 | 54.0 | — | Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revoc… |
| CVE-2026-46455 | 9.8 | 51.8 | — | Apache Camel: Camel-Keycloak: The access-token validity window is not verified because … |
| CVE-2026-28564 | 9.8 | 51.5 | — | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials |
| CVE-2026-14950 | 9.2 | 49.9 | — | Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session… |
| CVE-2026-53776 | 9.3 | 49.6 | — | Perry < 0.5.1166 JWT Expiration Bypass via verify_decode |
| CVE-2026-81637 | 2.3 | 48.0 | — | Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication |
| CVE-2026-48726 | 6.5 | 47.4 | — | Apache Airflow: revoke_token() unreachable in FabAuthManager / KeycloakAuthManager logo… |
| CVE-2022-50692 | 6.9 | 46.8 | — | SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Insufficient Session Expiration Vulnerability |
| CVE-2026-88262 | 8.7 | 46.4 | — | — |
| CVE-2026-12796 | 2.1 | 46.0 | — | BerriAI litellm SSO Authentication Flow ui_sso.py get_redirect_response_from_openid ses… |
| CVE-2026-48329 | 2.7 | 45.9 | — | ColdFusion | Insufficient Session Expiration (CWE-613) |
| CVE-2026-60053 | 9.1 | 45.8 | — | Apache Answer: Residual Administrative API Key Access After Role or Account Revocation |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 12 |
| openclaw | 5 |
| red hat | 5 |
| ibm | 4 |
| open-webui | 4 |
| wso2 | 4 |
| getgrav | 3 |
| hcl software | 3 |
| nocodb | 3 |
| team-alembic | 3 |
| @fastify/jwt | 2 |
| berriai | 2 |
| bludit | 2 |
| dell | 2 |
| error311 | 2 |
