Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-829
Weakness type CWE-829 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 134 | 128 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▃██▇▇▇
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 1 · 2026-04 1 · 2026-05 7 · 2026-06 26 · 2026-07 26 · 2026-08 22 · 2026-09 23 · 2026-10 22
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-0770 | 9.8 | 99.2 | KEV | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote C… |
| CVE-2025-32463 | 9.3 | 99.0 | KEV | Sudo Sudo |
| CVE-2026-59865 | 9.3 | 91.1 | — | Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiot… |
| CVE-2018-12120 | 8.1 | 91.0 | — | — |
| CVE-2018-11040 | 7.5 | 88.1 | — | — |
| CVE-2026-59867 | 7.1 | 83.7 | — | Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref |
| CVE-2026-73851 | 6.1 | 82.8 | — | Kiota: Path traversal in generated plugin manifest static_template.file reference (perc… |
| CVE-2026-44359 | 10.0 | 78.1 | — | Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target F… |
| CVE-2026-59864 | 9.3 | 70.6 | — | Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions |
| CVE-2026-71471 | 9.0 | 68.1 | — | Acm-search-v2-rhel9: search-v2-operator: hub search cr collector.imageoverride propagat… |
| CVE-2026-43003 | 7.5 | 65.8 | — | — |
| CVE-2026-67623 | 8.6 | 63.9 | — | Mistral Vibe < 2.23.3 Arbitrary Command Execution via git fsmonitor Hook |
| CVE-2026-43999 | 9.9 | 61.2 | — | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandb… |
| CVE-2026-86169 | 8.7 | 60.2 | — | Axolotl before 0.19.0 Remote Code Execution via Multipack Patching |
| CVE-2026-5241 | 9.6 | 60.1 | — | Policy Bypass in LightGlue Nested Config Resolution in huggingface/transformers |
| CVE-2026-58116 | 9.3 | 59.1 | — | LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path |
| CVE-2026-70267 | 7.2 | 58.8 | — | Microsoft Office SharePoint Remote Code Execution Vulnerability |
| CVE-2026-62902 | 6.5 | 58.2 | — | .NET Information Disclosure Vulnerability |
| CVE-2026-57102 | 8.8 | 56.4 | — | Visual Studio Code Security Feature Bypass Vulnerability |
| CVE-2026-40501 | 8.6 | 56.0 | — | Cherry Studio RCE via SearchService nodeIntegration Misconfiguration |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 13 |
| jetbrains | 11 |
| eclipse foundation | 5 |
| netbox-community | 4 |
| red hat | 4 |
| dell | 3 |
| pnpm | 3 |
| vim | 3 |
| concrete cms | 2 |
| docker | 2 |
| duck-organization | 2 |
| mervinpraison | 2 |
| mistralai | 2 |
| mitel | 2 |
| openclaw | 2 |
