Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-696
Weakness type CWE-696 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 19 | 19 | 0 |
Monthly trend
▃▂▆▃▆█
2026-05 2 · 2026-06 1 · 2026-07 4 · 2026-08 2 · 2026-09 4 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-44108 | 9.3 | 56.8 | — | Firewall bypass during shutdown |
| CVE-2026-65100 | 6.3 | 46.6 | — | Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed hea… |
| CVE-2026-14169 | 8.1 | 42.7 | — | ads-tec Industrial IT: Account lockout via non-atomic user creation |
| CVE-2026-109162 | 6.3 | 41.9 | — | TYPO3 CMS - Security Misconfiguration in Form Framework |
| CVE-2026-67217 | 6.9 | 36.1 | — | cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation |
| CVE-2026-56355 | 3.7 | 33.1 | — | — |
| CVE-2026-68930 | 6.5 | 30.0 | — | Russh: Channel-scoped server callbacks can be reached without an open channel |
| CVE-2026-73446 | 7.0 | 17.2 | — | Security Advisory 0160 |
| CVE-2026-26287 | 7.1 | 14.6 | — | External Secrets Operator: label enforcement bypass in webhook generator enables secret… |
| CVE-2026-59305 | 3.8 | 10.6 | — | Partition interceptor may be improperly added while sending message |
| CVE-2026-49317 | 1.0 | 9.7 | — | Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent … |
| CVE-2026-49318 | 1.0 | 9.7 | — | Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent … |
| CVE-2026-73535 | 8.8 | 9.2 | — | Gitea second-factor bypass through OpenID identity linking |
| CVE-2026-93330 | 4.3 | 8.2 | — | — |
| CVE-2026-103353 | 5.3 | 7.6 | — | WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability |
| CVE-2026-110450 | 8.0 | 3.8 | — | — |
| CVE-2026-93304 | 6.3 | 3.8 | — | (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange |
| CVE-2026-105745 | 7.8 | 1.7 | — | Docling: Plugin entry points are imported before the allow_external_plugins check |
| CVE-2026-103012 | 2.0 | 1.0 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| indian motorcycle | 2 |
| ads-tec industrial it | 1 |
| anthropic | 1 |
| apache | 1 |
| arista networks | 1 |
| davegamble | 1 |
| devolutions | 1 |
| docling-project | 1 |
| eugeny | 1 |
| external-secrets | 1 |
| gitea | 1 |
| gnu | 1 |
| nixos | 1 |
| phoenix contact | 1 |
| spring | 1 |
