Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-749
Weakness type CWE-749 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 57 | 51 | 4 |
Monthly trend
▅▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁█▁▁▁▁▅▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁█▁▁▁▁▁▁▁▁▅▁
2025-03 0 · 2025-04 2 · 2025-05 0 · 2025-06 0 · 2025-07 0 · 2025-08 0 · 2025-09 0 · 2025-10 0 · 2025-11 0 · 2025-12 0 · 2026-01 1 · 2026-02 0
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2010-0738 | 5.3 | 99.5 | KEV | Red Hat JBoss |
| CVE-2010-1428 | 7.5 | 99.2 | KEV | Red Hat JBoss |
| CVE-2006-1547 | 7.5 | 99.0 | KEV | Apache Struts 1 |
| CVE-2018-19322 | 7.8 | 78.3 | KEV | GIGABYTE Multiple Products |
| CVE-2025-26651 | 6.5 | 84.8 | — | Windows Local Session Manager (LSM) Denial of Service Vulnerability |
| CVE-2025-9611 | 7.2 | 68.2 | — | Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Valida… |
| CVE-2026-54753 | 5.9 | 67.8 | — | Nx: `nx graph` dev server permissive CORS policy |
| CVE-2026-77521 | 10.0 | 63.7 | — | MaxKB: Prompt-injectable agent can lead to command execution |
| CVE-2026-68823 | 9.1 | 60.0 | — | Azure Confidential Ledger Remote Code Execution Vulnerability |
| CVE-2026-41283 | 9.9 | 59.4 | — | — |
| CVE-2026-53633 | 9.8 | 58.8 | — | Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE |
| CVE-2026-45489 | 6.5 | 58.3 | — | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
| CVE-2026-109412 | 9.9 | 58.1 | — | — |
| CVE-2026-18901 | 7.3 | 57.4 | — | H3C NX15 Web API esps service.add routine |
| CVE-2026-106513 | 6.9 | 49.6 | — | MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Con… |
| CVE-2025-53827 | 9.1 | 48.4 | — | ownCloud Core: Updater has an exposed dangerous method or function |
| CVE-2026-55454 | 9.9 | 47.8 | — | Appsmith: Caddy admin API exposed without authentication |
| CVE-2026-89139 | 8.7 | 46.6 | — | Temporal Server worker deployment compute provider executes a caller-supplied command o… |
| CVE-2026-44107 | 8.7 | 45.4 | — | Exposed Reboot via Modbus |
| CVE-2026-48056 | 10.0 | 45.0 | — | Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 4 |
| parallels | 3 |
| nuxt | 2 |
| truelockmc | 2 |
| 1panel-dev | 1 |
| @payloadcms | 1 |
| acode-foundation | 1 |
| appsmithorg | 1 |
| asus | 1 |
| cisco | 1 |
| convertigo | 1 |
| eclipse foundation | 1 |
| electerm | 1 |
| flowring technology | 1 |
| gitroomhq | 1 |
