Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-754
Weakness type CWE-754 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 120 | 98 | 4 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▂▁▁▂▁▂▁▁▂▂▂▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▆▃▆█▇▆
2025-11 0 · 2025-12 0 · 2026-01 3 · 2026-02 1 · 2026-03 1 · 2026-04 0 · 2026-05 17 · 2026-06 5 · 2026-07 16 · 2026-08 22 · 2026-09 18 · 2026-10 15
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-3393 | 8.7 | 98.2 | KEV | PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet |
| CVE-2023-41993 | 8.8 | 97.8 | KEV | Apple Multiple Products |
| CVE-2023-41992 | 7.8 | 95.4 | KEV | Apple Multiple Products |
| CVE-2025-39682 | 9.8 | 86.6 | KEV | tls: fix handling of zero-length records on the rx_list |
| CVE-2019-19646 | 9.8 | 94.4 | — | — |
| CVE-2023-5678 | 5.3 | 91.3 | — | Excessive time spent in DH check / generation with large Q parameter value |
| CVE-2021-27568 | 5.9 | 86.7 | — | — |
| CVE-2026-25639 | 7.5 | 80.3 | — | Axios affected by Denial of Service via __proto__ Key in mergeConfig |
| CVE-2026-39929 | 8.7 | 79.8 | — | Lakeside SysTrack Agent LsiAgent.exe Out-of-Bounds Read via UDP |
| CVE-2026-5946 | 7.5 | 76.8 | — | Invalid handling of CLASS != IN |
| CVE-2024-50602 | 5.9 | 65.5 | — | — |
| CVE-2024-42284 | 7.8 | 59.7 | — | tipc: Return non-zero value from tipc_udp_addr2str() on error |
| CVE-2025-69420 | 7.5 | 58.9 | — | Missing ASN1_TYPE validation in TS_RESP_verify_response() function |
| CVE-2026-56812 | 6.3 | 55.6 | — | Phoenix JavaScript presence client crashes on presence keys colliding with Object.proto… |
| CVE-2026-33939 | 7.5 | 54.3 | — | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation |
| CVE-2026-44324 | 6.5 | 52.2 | — | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interf… |
| CVE-2026-44316 | 7.5 | 50.4 | — | free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 40… |
| CVE-2026-44322 | 7.5 | 50.4 | — | free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failur… |
| CVE-2026-73314 | 8.7 | 50.2 | — | XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook |
| CVE-2026-69185 | 7.5 | 49.1 | — | Socket.IO: Zero-attachment Memory Exhaustion |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| linux | 14 |
| 11 | |
| palo alto networks | 8 |
| juniper networks | 6 |
| free5gc | 4 |
| indian motorcycle | 4 |
| mattermost | 4 |
| openssl | 4 |
| apple | 2 |
| atn-b1 | 2 |
| eugeny | 2 |
| nimiq | 2 |
| rabbitmq | 2 |
| undici | 2 |
| @backstage | 1 |
