Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-674
Weakness type CWE-674 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 246 | 225 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▃▆▅▇█▇
2025-11 0 · 2025-12 0 · 2026-01 3 · 2026-02 1 · 2026-03 5 · 2026-04 3 · 2026-05 12 · 2026-06 33 · 2026-07 29 · 2026-08 46 · 2026-09 50 · 2026-10 43
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-8285 | 7.5 | 95.5 | — | — |
| CVE-2020-12243 | 7.5 | 91.7 | — | — |
| CVE-2020-28196 | 7.5 | 91.2 | — | — |
| CVE-2022-25313 | 6.5 | 88.3 | — | — |
| CVE-2024-5971 | 7.5 | 86.8 | — | Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket |
| CVE-2020-6071 | 7.5 | 84.5 | — | — |
| CVE-2021-3997 | 5.5 | 77.1 | — | — |
| CVE-2024-8176 | 7.5 | 71.1 | — | Libexpat: expat: improper restriction of xml entity expansion depth in libexpat |
| CVE-2026-49451 | 7.5 | 68.6 | — | Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing |
| CVE-2022-37315 | 7.5 | 67.7 | — | — |
| CVE-2026-69378 | 7.5 | 67.0 | — | Microsoft Exchange Server Denial of Service Vulnerability |
| CVE-2026-25048 | 8.7 | 66.9 | — | xgrammar: Multi-layer nesting causes DoS |
| CVE-2026-15830 | 6.9 | 65.4 | — | Potential denial-of-service vulnerability via nested geometry collections |
| CVE-2026-58280 | 7.5 | 65.2 | — | .NET Denial of Service Vulnerability |
| CVE-2026-41606 | 5.3 | 65.1 | — | Apache Thrift: c_glib dispatch stack overflow |
| CVE-2026-32141 | 7.5 | 63.1 | — | flatted: Unbounded recursion DoS in parse() revive phase |
| CVE-2026-61483 | 7.5 | 63.1 | — | Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow… |
| CVE-2026-30922 | 7.5 | 61.1 | — | pyasn1 Vulnerable to Denial of Service via Unbounded Recursion |
| CVE-2026-42039 | 6.9 | 61.0 | — | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data |
| CVE-2026-0990 | 5.9 | 60.7 | — | Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 22 |
| linux | 20 |
| elastic | 11 |
| ibm | 10 |
| imagemagick | 8 |
| red hat | 7 |
| offis | 5 |
| scriban | 5 |
| surrealdb | 5 |
| messagepack-csharp | 4 |
| qt | 4 |
| autodesk | 3 |
| legion of the bouncy castle | 3 |
| microsoft | 3 |
| protobufjs | 3 |
