Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-704
Weakness type CWE-704 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 30 | 26 | 0 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▂▁▁▁▁▁▁▁▃▄▅█▇▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 3 · 2026-07 4 · 2026-08 7 · 2026-09 6 · 2026-10 4
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-10735 | 7.5 | 91.4 | — | — |
| CVE-2026-15826 | 9.8 | 90.1 | — | User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusi… |
| CVE-2021-35942 | 9.1 | 86.0 | — | — |
| CVE-2026-44324 | 6.5 | 52.2 | — | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interf… |
| CVE-2026-59871 | 7.5 | 49.8 | — | node-tar: Process crash via PAX numeric path type confusion |
| CVE-2026-45685 | 7.5 | 49.3 | — | OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages |
| CVE-2026-46597 | 7.5 | 48.6 | — | Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh |
| CVE-2026-55076 | 7.4 | 48.1 | — | Coder's OIDC email_verified type coercion bypass enables account takeover via unverifie… |
| CVE-2025-51678 | 7.5 | 48.1 | — | — |
| CVE-2026-18675 | 5.3 | 45.5 | — | Kong Mesh: control plane denial of service via a malformed dataplane token with a non-s… |
| CVE-2026-73429 | 5.3 | 41.9 | — | Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) |
| CVE-2026-50278 | 6.5 | 37.8 | — | iccDEV: CIccEmbedIO::Read8() size_t underflow |
| CVE-2026-48140 | 7.1 | 37.3 | — | Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream |
| CVE-2026-53798 | 6.9 | 35.6 | — | rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping |
| CVE-2026-10080 | 6.5 | 34.8 | — | Boards plugin panics on WebSocket command with non-string field types |
| CVE-2026-20249 | 8.6 | 32.6 | — | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense So… |
| CVE-2026-58822 | 9.8 | 30.7 | — | — |
| CVE-2026-28609 | 8.8 | 29.6 | — | — |
| CVE-2026-86348 | 4.3 | 29.0 | — | MS Calendar plugin: unrecovered handler panics from malformed post-action requests coul… |
| CVE-2026-104634 | 2.3 | 26.1 | — | beam_mcp: JSON boolean and null tool arguments reach dispatch as strings |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 3 | |
| linux | 2 |
| mattermost | 2 |
| microsoft | 2 |
| cisco | 1 |
| coder | 1 |
| cozmoslabs | 1 |
| eugeny | 1 |
| free5gc | 1 |
| golang.org/x/crypto | 1 |
| internationalcolorconsortium | 1 |
| isaacs | 1 |
| kong | 1 |
| ljharb | 1 |
| ni | 1 |
