Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-664
Weakness type CWE-664 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 22 | 19 | 1 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▂▁▃▆██
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 1 · 2026-06 0 · 2026-07 2 · 2026-08 4 · 2026-09 6 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2022-27518 | 9.8 | 94.0 | KEV | Unauthenticated remote arbitrary code execution |
| CVE-2026-43503 | 8.8 | 80.3 | — | net: skbuff: propagate shared-frag marker through frag-transfer helpers |
| CVE-2026-20274 | 9.8 | 53.4 | — | Cisco IOS XR Software Security Hardening Release: September 2026 |
| CVE-2025-34226 | 7.1 | 50.7 | — | OpenPLC Runtime v3 Persistent DoS |
| CVE-2026-18549 | 7.5 | 47.8 | — | @fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit |
| CVE-2026-54251 | 8.7 | 41.9 | — | netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decry… |
| CVE-2026-20269 | 8.6 | 39.0 | — | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-20158 | 7.5 | 39.0 | — | Cisco RoomOS Security Hardening Release - Resource Lifetime Management Vulnerabilities |
| CVE-2026-102026 | 8.7 | 38.5 | — | Junos OS and Junos OS Evolved: An attacker causes a routing-daemon crash when BGP RIB s… |
| CVE-2024-22365 | 5.5 | 38.3 | — | — |
| CVE-2026-68908 | 5.3 | 37.7 | — | libIEC61850: Oversized RptID can trigger invalid free of a stack-backed visible string … |
| CVE-2026-57446 | 5.3 | 32.8 | — | libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* ha… |
| CVE-2026-20353 | 9.8 | 32.3 | — | Cisco Secure Email Gateway Security Hardening Release |
| CVE-2026-86203 | 6.3 | 26.9 | — | PocketMine-MP before 5.39.2 Item Duplication via Despawn State |
| CVE-2026-76500 | 9.8 | 24.0 | — | Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Im… |
| CVE-2026-76282 | 8.8 | 20.9 | — | Improper Control of a Resource Through its Lifetime in Splunk Enterprise |
| CVE-2026-79289 | 3.1 | 18.7 | — | — |
| CVE-2026-76467 | 7.5 | 15.5 | — | Cisco Meraki Software Hardening Release - Resource Lifetime Management Vulnerabilities |
| CVE-2026-79603 | 4.3 | 11.9 | — | Unconditionally do TLB flushing ahead of page scrubbing |
| CVE-2026-20336 | 8.8 | 8.8 | — | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Softw… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| cisco | 7 |
| mz-automation | 2 |
| @fastify/multipart | 1 |
| apple | 1 |
| autonomy logic | 1 |
| citrix | 1 |
| 1 | |
| io.netty.incubator | 1 |
| juniper networks | 1 |
| linux | 1 |
| mullvad | 1 |
| netty | 1 |
| pmmp | 1 |
| splunk | 1 |
| xen | 1 |
