Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-799
Weakness type CWE-799 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 21 | 21 | 0 |
Monthly trend
▃▃▆█▆
2026-06 2 · 2026-07 2 · 2026-08 5 · 2026-09 7 · 2026-10 5
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-19898 | 2.9 | 54.2 | — | VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authent… |
| CVE-2026-93650 | 2.9 | 51.8 | — | Saleor throttling.py get_client_ip excessive authentication |
| CVE-2026-75773 | 2.9 | 50.3 | — | karakeep-app karakeep Login Endpoint auth.ts authorize excessive authentication |
| CVE-2026-19895 | 2.9 | 49.1 | — | opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive auth… |
| CVE-2026-19897 | 2.9 | 46.1 | — | mangroup dtale Login Endpoint auth.py login excessive authentication |
| CVE-2026-54738 | 6.5 | 45.4 | — | Lemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo |
| CVE-2026-85586 | 6.9 | 41.0 | — | phpMyFAQ before 4.1.8 CAPTCHA Bypass via store parameter |
| CVE-2026-111874 | 2.9 | 40.3 | — | OpenCATS Career Portal CareersUI.php processLogin excessive authentication |
| CVE-2026-54594 | 5.3 | 37.7 | — | OmniBlocks: Spamming in Discussions tab possible via disc.yml |
| CVE-2026-10216 | 2.9 | 33.4 | — | unitedbyai droidclaw claim Endpoint pairing.ts excessive authentication |
| CVE-2026-105237 | 2.9 | 33.2 | — | linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication |
| CVE-2024-23565 | 5.3 | 32.9 | — | — |
| CVE-2026-33434 | 7.1 | 32.8 | — | Wazuh: Rate Limit Bypass via /events Endpoint |
| CVE-2026-107830 | 6.9 | 30.8 | — | Jivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS End… |
| CVE-2026-5233 | 7.1 | 28.0 | — | Missing Rate Limiting in Mia Technologies' Pizzy Library |
| CVE-2026-84461 | 6.9 | 23.9 | — | Zammad: Missing rate limiting allows password brute-forcing during two-factor login |
| CVE-2026-100603 | 8.7 | 20.5 | — | ClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports |
| CVE-2025-36045 | 4.3 | 16.8 | — | TS4300 Tape Library addresses security vulnerability |
| CVE-2025-13882 | 5.3 | 15.0 | — | Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager. |
| CVE-2026-97300 | 6.5 | 10.1 | — | WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 2 |
| arraytics | 1 |
| banq | 1 |
| hclsoftware | 1 |
| karakeep-app | 1 |
| lemmynet | 1 |
| linlinjava | 1 |
| mangroup | 1 |
| mia technology | 1 |
| omniblocks | 1 |
| openclaw | 1 |
| opensourcepos | 1 |
| pusula communication, it, and internet industry and trade co | 1 |
| thorsten | 1 |
| unitedbyai | 1 |
