Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-789
Weakness type CWE-789 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 164 | 162 | 0 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃▃▅▇▇█
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 0 · 2026-05 9 · 2026-06 14 · 2026-07 26 · 2026-08 33 · 2026-09 37 · 2026-10 42
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-49975 | 7.5 | 90.8 | — | Apache HTTP Server: mod_http2 denial of service |
| CVE-2024-43484 | 7.5 | 87.0 | — | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2026-66733 | 8.7 | 74.7 | — | Sonic 3 A.I.R. Unbounded Memory Allocation DoS via ReceivedPacketCache |
| CVE-2026-43868 | 5.3 | 67.7 | — | Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern |
| CVE-2026-40378 | 7.5 | 67.0 | — | Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability |
| CVE-2026-42440 | 7.5 | 64.1 | — | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader |
| CVE-2026-42154 | 7.5 | 56.2 | — | Prometheus: remote read endpoint allows denial of service via crafted snappy payload |
| CVE-2026-65315 | 8.7 | 56.0 | — | Ollama Remote Denial of Service via Attacker-Controlled Allocation in GGUF Metadata Parser |
| CVE-2026-85445 | 8.7 | 55.1 | — | MOOS-IvP through 24.8.1 BHV_IPF Demultiplexer Memory Exhaustion via Packet Count |
| CVE-2026-66273 | 7.5 | 54.9 | — | Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-aut… |
| CVE-2026-67551 | 7.5 | 54.9 | — | Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pr… |
| CVE-2026-67589 | 7.5 | 54.9 | — | Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-aut… |
| CVE-2026-85442 | 8.7 | 54.5 | — | MOOS core-moos through 10.4.0 MOOSDB Denial of Service via Unbounded Packet Allocation |
| CVE-2026-55407 | 6.3 | 54.2 | — | Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Alloca… |
| CVE-2026-85324 | 7.5 | 54.1 | — | Active Directory Federation Services (AD FS) Denial of Service Vulnerability |
| CVE-2026-91752 | 8.7 | 53.7 | — | GNU libextractor before 1.15 Stack Overflow via OLE2 |
| CVE-2026-50734 | 7.5 | 53.7 | — | Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWi… |
| CVE-2026-53916 | 7.5 | 53.7 | — | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in… |
| CVE-2026-53917 | 7.5 | 53.7 | — | Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: U… |
| CVE-2026-67211 | 7.5 | 53.7 | — | Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| apache | 23 |
| legion of the bouncy castle | 9 |
| eclipse foundation | 6 |
| elastic | 6 |
| python-pillow | 5 |
| borewit | 4 |
| microsoft | 3 |
| red hat | 3 |
| cisco | 2 |
| connectbot | 2 |
| djangoproject | 2 |
| emiago | 2 |
| envoyproxy | 2 |
| gnu | 2 |
| h2o | 2 |
