Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-823
Weakness type CWE-823 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 20 | 16 | 1 |
Monthly trend
▃▁▁▁▁▁▁▁▁▁▁▅▁▁▁▁▁▁▁▁▁▁▁▃▁▁▁▃▁▃█▅▆▆▅
2025-11 1 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 0 · 2026-05 1 · 2026-06 4 · 2026-07 2 · 2026-08 3 · 2026-09 3 · 2026-10 2
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2023-33106 | 8.4 | 55.4 | KEV | Use of Out-of-range Pointer Offset in Graphics |
| CVE-2017-20211 | 8.6 | 55.6 | — | UCanCode E-XD++ Visualization Enterprise Suite Untrusted Pointer Dereference RCE |
| CVE-2026-32829 | 8.2 | 52.9 | — | lz4_flex: Decompression can leak information from uninitialized memory or reused output… |
| CVE-2026-72642 | 8.8 | 47.8 | — | Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inferen… |
| CVE-2026-48977 | 7.7 | 39.7 | — | OpenSlide: Arbitrary memory write with crafted Ventana BIF file |
| CVE-2026-12290 | 8.1 | 32.4 | — | Memory safety bug fixed in Firefox 152 |
| CVE-2024-42386 | 7.5 | 30.2 | — | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2026-46244 | 9.1 | 23.6 | — | netfilter: nft_inner: Fix IPv6 inner_thoff desync |
| CVE-2026-104944 | 7.1 | 20.9 | — | Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500 |
| CVE-2024-42391 | 5.3 | 19.7 | — | Use of Out-of-range Pointer Offset in Mongoose Web Server library |
| CVE-2026-34193 | 4.3 | 12.3 | — | GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_… |
| CVE-2026-28764 | 7.8 | 12.0 | — | — |
| CVE-2026-45199 | 7.8 | 5.0 | — | GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers |
| CVE-2026-49744 | 7.8 | 4.9 | — | GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex() |
| CVE-2026-49745 | 7.8 | 4.9 | — | GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write into FW privdata via MMU ctx 0 |
| CVE-2026-21734 | 7.7 | 4.9 | — | GPU DDK - libusc OOB write at TreeRemove during WebGPU shader compilation |
| CVE-2026-49746 | 7.1 | 4.0 | — | GPU DDK - Dimension Mismatch and Integer Truncation in PMRDevPhysAddrOSMem |
| CVE-2026-107570 | 2.5 | 2.6 | — | Use of Out-of-range Pointer Offset in mutt |
| CVE-2026-31912 | 5.5 | 1.0 | — | OOBR in libpcap before 1.10.7 |
| CVE-2026-102757 | 8.5 | 1.0 | — | — |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| imagination technologies | 6 |
| cesanta | 2 |
| eclipse foundation | 1 |
| elastic | 1 |
| linux | 1 |
| mediaarea | 1 |
| mozilla | 1 |
| mutt | 1 |
| openslide | 1 |
| pseitz | 1 |
| qualcomm | 1 |
| the tcpdump group | 1 |
| tp-link systems | 1 |
| ucancode.net software | 1 |
