Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-682
Weakness type CWE-682 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 35 | 30 | 0 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▂▂▁▁▁▁▁▁▁▂▁▄▂▅▆█▇
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 0 · 2026-05 3 · 2026-06 1 · 2026-07 4 · 2026-08 6 · 2026-09 8 · 2026-10 7
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-14422 | 5.9 | 96.3 | — | — |
| CVE-2021-45960 | 8.8 | 91.1 | — | — |
| CVE-2026-71479 | 9.1 | 50.0 | — | New API: Integer overflow in quota billing yields negative charges (self-crediting) |
| CVE-2025-4435 | 7.5 | 47.1 | — | Tarfile extracts filtered members when errorlevel=0 |
| CVE-2026-53670 | 9.3 | 41.9 | — | PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pas… |
| CVE-2026-53671 | 9.3 | 41.9 | — | PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verifi… |
| CVE-2026-53706 | 8.8 | 41.9 | — | PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PAS… |
| CVE-2025-5372 | 8.8 | 41.6 | — | Libssh: incorrect return code handling in ssh_kdf() in libssh |
| CVE-2026-47247 | 7.5 | 39.9 | — | libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pi… |
| CVE-2026-20270 | 8.6 | 39.0 | — | Cisco IOS XE Software Security Hardening Release |
| CVE-2026-10512 | 2.3 | 37.7 | — | X25519 x86_64 assembly final reduction leaves non-canonical field element |
| CVE-2026-101963 | 8.7 | 37.3 | — | Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multih… |
| CVE-2026-16363 | 9.8 | 36.4 | — | JIT miscompilation in the JavaScript: WebAssembly component |
| CVE-2026-54754 | 9.6 | 36.1 | — | Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid … |
| CVE-2026-33487 | 7.5 | 34.6 | — | goxmldsig has validateSignature Loop Variable Capture Signature Bypass |
| CVE-2026-76043 | 8.8 | 34.1 | — | — |
| CVE-2026-44074 | 3.7 | 31.6 | — | Bitwise OR of errno values |
| CVE-2026-107721 | 5.9 | 25.3 | — | fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and pe… |
| CVE-2026-86736 | 5.3 | 21.0 | — | snipe-it before 8.7.0 Checkout Request Counter Integrity Failure |
| CVE-2026-20335 | 8.1 | 19.3 | — | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Softw… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| cisco | 4 |
| vbpf | 3 |
| 2 | |
| linux | 2 |
| netatalk | 2 |
| grokability | 1 |
| imagemagick | 1 |
| juniper networks | 1 |
| klever-io | 1 |
| ledger | 1 |
| libssh | 1 |
| macrozheng | 1 |
| mongodb | 1 |
| mozilla | 1 |
| nearform | 1 |
