Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-862
Weakness type CWE-862 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 3127 | 3099 | 10 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▄▅▆█▇
2025-11 2 · 2025-12 3 · 2026-01 4 · 2026-02 5 · 2026-03 2 · 2026-04 6 · 2026-05 138 · 2026-06 368 · 2026-07 455 · 2026-08 607 · 2026-09 797 · 2026-10 717
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2022-0543 | 10.0 | 99.9 | KEV | Redis Debian-specific Redis Servers |
| CVE-2023-52163 | 8.8 | 99.9 | KEV | Digiever DS-2105 Pro |
| CVE-2025-20362 | 8.6 | 99.8 | KEV | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense |
| CVE-2025-6205 | 9.1 | 99.5 | KEV | Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through R… |
| CVE-2021-30657 | 5.5 | 99.3 | KEV | Apple macOS |
| CVE-2024-57726 | 9.9 | 99.3 | KEV | SimpleHelp SimpleHelp |
| CVE-2021-37976 | 6.5 | 97.4 | KEV | Google Chromium |
| CVE-2021-30713 | 7.8 | 94.1 | KEV | Apple macOS |
| CVE-2025-40602 | 6.6 | 86.0 | KEV | SonicWall SMA1000 appliance |
| CVE-2026-84869 | 9.9 | 59.7 | KEV | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions |
| CVE-2023-5612 | 5.3 | 91.9 | — | Missing Authorization in GitLab |
| CVE-2026-73296 | 9.4 | 89.5 | — | Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control a… |
| CVE-2026-10768 | 9.8 | 81.6 | — | LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039 |
| CVE-2026-6639 | 7.5 | 80.3 | — | AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenti… |
| CVE-2026-11801 | 7.5 | 76.0 | — | WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Dis… |
| CVE-2026-48168 | 10.0 | 73.9 | — | PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name |
| CVE-2026-27771 | 8.2 | 71.9 | — | Gitea Composer package source links use insufficient permission checks |
| CVE-2026-12645 | 8.8 | 69.6 | — | — |
| CVE-2026-27604 | 10.0 | 69.2 | — | FOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Pr… |
| CVE-2026-55440 | 6.5 | 69.1 | — | Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 131 | |
| jeecgboot | 94 |
| frappe | 62 |
| microsoft | 62 |
| red hat | 41 |
| openclaw | 36 |
| misp | 33 |
| siyuan-note | 31 |
| apache | 30 |
| concrete cms | 29 |
| jenkins project | 27 |
| jetbrains | 26 |
| mervinpraison | 21 |
| arraytics | 20 |
| getgrav | 20 |
