Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-670
Weakness type CWE-670 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 30 | 27 | 0 |
Monthly trend
▂▁▁▁▂▁▁▁▁▂▁▁▁▁▁▁▁▁▁▃▇▃██▄
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 6 · 2026-07 2 · 2026-08 7 · 2026-09 7 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-53404 | 7.3 | 50.2 | — | Apache Tomcat: Bad ornext processing in RewriteValve |
| CVE-2026-55276 | 9.1 | 47.9 | — | Apache Tomcat: Logged effective web.xml is incomplete |
| CVE-2026-48844 | 7.5 | 42.1 | — | — |
| CVE-2026-20171 | 6.8 | 39.0 | — | Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability |
| CVE-2026-19487 | 5.3 | 34.7 | — | Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match resul… |
| CVE-2026-55624 | 5.3 | 32.4 | — | MintyItanium Lost-Auction takes items like barrier blocks out from search GUI |
| CVE-2026-92932 | 5.1 | 31.4 | — | MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSR… |
| CVE-2026-56307 | 5.3 | 29.7 | — | Cap-go - Broken Cursor Pagination in /private/devices Endpoint |
| CVE-2026-16392 | 9.1 | 28.4 | — | JIT miscompilation in the JavaScript Engine: JIT component |
| CVE-2026-56328 | 7.1 | 26.9 | — | Capgo - Integrity Issue in Release Routing via Multiple Public Channels |
| CVE-2026-7656 | 6.8 | 24.4 | — | Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Z… |
| CVE-2026-109722 | 8.1 | 22.8 | — | JIT miscompilation in the JavaScript Engine: JIT component |
| CVE-2026-73468 | 7.1 | 20.2 | — | Security Advisory 0175 |
| CVE-2024-47745 | 7.8 | 19.7 | — | mm: call the security_mmap_file() LSM hook in remap_file_pages() |
| CVE-2026-96760 | 9.8 | 18.9 | — | Authlib library contains a signature‑verification bypass vulnerability |
| CVE-2026-102110 | 5.9 | 13.6 | — | Missing authentication on a Kiteworks appliance setup function |
| CVE-2022-49393 | 5.5 | 13.3 | — | misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl |
| CVE-2026-14935 | 3.7 | 13.1 | — | Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerpr… |
| CVE-2025-38291 | 5.5 | 12.2 | — | wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash |
| CVE-2026-102124 | 6.5 | 10.2 | — | Kiteworks Core Missing Authentication for Critical Function |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| linux | 5 |
| mozilla | 3 |
| rocq-prover | 3 |
| apache | 2 |
| kiteworks | 2 |
| openbsd | 2 |
| arista networks | 1 |
| asynchttpclient | 1 |
| authlib | 1 |
| cap-go | 1 |
| capgo | 1 |
| cisco | 1 |
| mintyitanium | 1 |
| misp | 1 |
| red hat | 1 |
