Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-772
Weakness type CWE-772 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 65 | 59 | 1 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▅▅▆▇█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 1 · 2026-04 0 · 2026-05 2 · 2026-06 9 · 2026-07 8 · 2026-08 10 · 2026-09 13 · 2026-10 15
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2024-20481 | 5.8 | 96.9 | KEV | Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) |
| CVE-2024-2398 | 8.6 | 98.5 | — | HTTP/2 push headers memory-leak |
| CVE-2019-19956 | 7.5 | 92.9 | — | — |
| CVE-2018-19139 | 5.5 | 76.3 | — | — |
| CVE-2026-3104 | 7.5 | 67.0 | — | Memory leak in code preparing DNSSEC proofs of non-existence |
| CVE-2024-1300 | 5.4 | 64.1 | — | Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support |
| CVE-2026-69664 | 8.7 | 60.5 | — | httpd parks a request worker indefinitely on a malformed chunk size sent after the headers |
| CVE-2026-48043 | 7.5 | 58.4 | — | netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener … |
| CVE-2026-48006 | 8.7 | 57.4 | — | Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator |
| CVE-2026-40209 | 5.3 | 52.3 | — | Denial of service via IXFR queries |
| CVE-2026-71380 | 8.7 | 51.2 | — | httpd applies no timeout while receiving a request body, parking a worker on a stalled … |
| CVE-2026-92983 | 8.7 | 50.5 | — | InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch |
| CVE-2026-63128 | 7.5 | 49.1 | — | RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server trans… |
| CVE-2026-39830 | 9.1 | 48.7 | — | Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypt… |
| CVE-2026-61387 | 6.9 | 48.6 | — | — |
| CVE-2026-77384 | 7.5 | 48.1 | — | libp2p: Circuit relay v2 server reservation refresh leaks abort listeners and allows re… |
| CVE-2026-59654 | 6.8 | 47.2 | — | Apache CloudStack: DoS caused by database connections leak |
| CVE-2026-36590 | 7.5 | 47.0 | — | — |
| CVE-2026-20250 | 8.6 | 44.8 | — | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense So… |
| CVE-2026-85718 | 5.9 | 43.8 | — | AsyncHttpClient: Connection permit leak on TLS handshake failure causes per-host denial… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| red hat | 7 |
| apache | 6 |
| linux | 6 |
| netty | 4 |
| zephyrproject | 4 |
| cisco | 3 |
| erlang | 2 |
| modelcontextprotocol | 2 |
| nlnet labs | 2 |
| asynchttpclient | 1 |
| bytecodealliance | 1 |
| corazawaf | 1 |
| coturn | 1 |
| curl | 1 |
| eclipse foundation | 1 |
