Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-706
Weakness type CWE-706 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 58 | 52 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▃▃▇█▇
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 4 · 2026-07 5 · 2026-08 13 · 2026-09 15 · 2026-10 13
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2020-15505 | 9.8 | 100.0 | KEV | Ivanti MobileIron Multiple Products |
| CVE-2021-40539 | 9.8 | 99.9 | KEV | Zoho ManageEngine |
| CVE-2021-24122 | 5.9 | 97.7 | — | Apache Tomcat information disclosure |
| CVE-2021-22924 | 3.7 | 93.5 | — | — |
| CVE-2022-27778 | 8.1 | 89.9 | — | — |
| CVE-2026-65816 | 10.0 | 61.4 | — | Azure Arc Elevation of Privilege Vulnerability |
| CVE-2026-81383 | 7.4 | 59.6 | — | Visual Studio Code Information Disclosure Vulnerability |
| CVE-2026-92262 | 9.9 | 51.3 | — | MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass. |
| CVE-2026-67602 | 9.3 | 49.6 | — | phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache |
| CVE-2026-13097 | 8.7 | 46.0 | — | Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware unique… |
| CVE-2026-62685 | 8.1 | 45.0 | — | File Browser: Colliding username normalization gives two users the same home directory |
| CVE-2026-92951 | 9.4 | 44.2 | — | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver |
| CVE-2026-62190 | 8.7 | 42.1 | — | OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper |
| CVE-2026-78985 | 9.6 | 41.7 | — | — |
| CVE-2026-87547 | 9.6 | 41.7 | — | — |
| CVE-2026-13372 | 7.2 | 41.4 | — | — |
| CVE-2026-107822 | 6.4 | 39.9 | — | MariaDB: database privilege escalation via user / role name collision in the acl cache |
| CVE-2026-87613 | 9.0 | 39.3 | — | — |
| CVE-2026-29036 | 8.7 | 37.1 | — | cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding |
| CVE-2026-87618 | 8.3 | 36.9 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 25 | |
| devolutions | 2 |
| gitlab | 2 |
| mariadb | 2 |
| microsoft | 2 |
| apache | 1 |
| davegamble | 1 |
| error311 | 1 |
| filebrowser | 1 |
| gerrit | 1 |
| gitea | 1 |
| juniper networks | 1 |
| kludex | 1 |
| linux | 1 |
| nextlevelbuilder | 1 |
