Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-776
Weakness type CWE-776 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 26 | 22 | 0 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▁▂▇▇▅█▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 1 · 2026-04 0 · 2026-05 1 · 2026-06 4 · 2026-07 4 · 2026-08 3 · 2026-09 5 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2019-15903 | 7.5 | 93.8 | — | — |
| CVE-2021-3541 | 6.5 | 81.1 | — | — |
| CVE-2024-28757 | 7.5 | 80.5 | — | — |
| CVE-2026-26278 | 7.5 | 64.6 | — | fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) |
| CVE-2026-29074 | 7.5 | 61.1 | — | SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) |
| CVE-2026-41673 | 8.7 | 58.4 | — | xmldom: Denial of service via uncontrolled recursion in XML serialization |
| CVE-2026-45304 | 8.7 | 51.6 | — | Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expan… |
| CVE-2026-45133 | 8.2 | 49.1 | — | Symfony: [Yaml] Harden the parser when handling untrusted input |
| CVE-2026-44020 | 7.5 | 47.7 | — | Docling: Unsafe XML Entity Expansion in USPTO Patent Backend |
| CVE-2026-14979 | 7.5 | 44.7 | — | IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expa… |
| CVE-2026-78681 | 8.7 | 43.0 | — | NLTK before 3.10.3 Entity Expansion DoS via ElementTree |
| CVE-2026-12993 | 6.5 | 42.8 | — | Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service v… |
| CVE-2026-73569 | 8.7 | 41.9 | — | fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits |
| CVE-2026-45771 | 7.5 | 40.6 | — | Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion |
| CVE-2026-3415 | 8.7 | 40.5 | — | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products All… |
| CVE-2026-108039 | 7.5 | 38.2 | — | Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element … |
| CVE-2026-54077 | 7.1 | 37.4 | — | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users |
| CVE-2026-14865 | 5.3 | 36.1 | — | XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX |
| CVE-2026-74030 | 6.9 | 33.0 | — | Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion |
| CVE-2023-52426 | 5.5 | 31.6 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 2 |
| docling-project | 2 |
| ibm | 2 |
| naturalintelligence | 2 |
| symfony | 2 |
| arcadedata | 1 |
| com.arcadedb | 1 |
| fnando | 1 |
| nltk | 1 |
| progress | 1 |
| red hat | 1 |
| sap_se | 1 |
| signalwire | 1 |
| svg | 1 |
| the opennms group | 1 |
