Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-639
Weakness type CWE-639 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 1511 | 1503 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▄▅▇█▇
2025-11 0 · 2025-12 2 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 53 · 2026-06 164 · 2026-07 243 · 2026-08 329 · 2026-09 383 · 2026-10 330
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-55255 | 8.4 | 58.6 | KEV | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attac… |
| CVE-2026-28316 | 9.1 | 81.7 | — | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
| CVE-2026-8679 | 7.5 | 78.8 | — | AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference t… |
| CVE-2026-89063 | 7.5 | 75.8 | — | Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Refer… |
| CVE-2021-38624 | 6.5 | 74.4 | — | Windows Key Storage Provider Security Feature Bypass Vulnerability |
| CVE-2026-47101 | 8.7 | 70.6 | — | LiteLLM < 1.83.14 Privilege Escalation via API Key Generation |
| CVE-2026-8839 | 5.3 | 70.0 | — | MapPress Maps for WordPress <= 2.96.6 - Unauthenticated Insecure Direct Object Referenc… |
| CVE-2026-100885 | 5.5 | 62.1 | — | Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization |
| CVE-2026-54568 | 4.3 | 61.5 | — | Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to R… |
| CVE-2026-69558 | 8.6 | 61.4 | — | Microsoft Partner Center Information Disclosure Vulnerability |
| CVE-2026-73298 | 8.7 | 61.2 | — | Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/wr… |
| CVE-2026-57205 | 4.3 | 59.3 | — | SimpleChat: Authenticated users can access other users' profile metadata through user I… |
| CVE-2026-46414 | 8.8 | 57.5 | — | Microsoft UFO WebSocket role spoofing allows authenticated peer task hijacking |
| CVE-2023-53955 | 9.3 | 57.5 | — | SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References |
| CVE-2026-85873 | 6.5 | 56.6 | — | Skype for Business Elevation of Privilege Vulnerability |
| CVE-2026-86465 | 6.5 | 56.1 | — | Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via… |
| CVE-2026-73841 | 8.8 | 56.1 | — | OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo open… |
| CVE-2026-69865 | 10.0 | 55.7 | — | Microsoft Container Registry Elevation of Privilege Vulnerability |
| CVE-2026-83711 | 10.0 | 55.7 | — | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability |
| CVE-2026-28302 | 9.1 | 55.3 | — | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| red hat | 29 |
| apache | 19 |
| makeplane | 19 |
| microsoft | 17 |
| ibm | 15 |
| n8n-io | 15 |
| misp | 14 |
| flowiseai | 13 |
| open-webui | 12 |
| roskus | 12 |
| dromara | 11 |
| elastic | 11 |
| grokability | 11 |
| concrete cms | 10 |
| gitea | 10 |
