Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-915
Weakness type CWE-915 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 105 | 105 | 0 |
Monthly trend
▂▂▃█▇▆▆▅
2026-03 2 · 2026-04 5 · 2026-05 6 · 2026-06 24 · 2026-07 19 · 2026-08 18 · 2026-09 16 · 2026-10 15
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-40175 | 4.8 | 80.7 | — | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain |
| CVE-2026-50160 | 10.0 | 76.8 | — | Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite |
| CVE-2026-29063 | 8.7 | 75.5 | — | Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Proto… |
| CVE-2026-72710 | 9.3 | 65.7 | — | SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection |
| CVE-2026-44495 | 7.7 | 63.4 | — | Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config… |
| CVE-2026-78416 | 8.7 | 62.8 | — | Authenticated RCE via `condition.config` JSON cleanse bypass |
| CVE-2026-59721 | 7.2 | 62.5 | — | Hoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injection |
| CVE-2026-46625 | 7.5 | 61.7 | — | JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute i… |
| CVE-2026-34427 | 8.7 | 60.9 | — | Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save |
| CVE-2026-44494 | 8.7 | 60.0 | — | Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` |
| CVE-2026-42033 | 7.4 | 59.7 | — | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request… |
| CVE-2026-47102 | 8.7 | 56.5 | — | LiteLLM < 1.83.10 Privilege Escalation via User Update |
| CVE-2026-42041 | 6.5 | 56.1 | — | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge S… |
| CVE-2026-72778 | 8.7 | 55.9 | — | Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config |
| CVE-2026-84645 | 8.8 | 55.4 | — | — |
| CVE-2026-42264 | 9.1 | 54.7 | — | Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection… |
| CVE-2026-18617 | 8.8 | 53.5 | — | Data-science-pipelines-operator: dspo: mysql dsn parameter injection via customextrapar… |
| CVE-2026-83557 | 5.6 | 52.9 | — | jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's uns… |
| CVE-2026-93752 | 8.7 | 51.5 | — | CSSOM through 0.5.0 Denial of Service via length Property |
| CVE-2026-69258 | 8.8 | 50.9 | — | Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `ov… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| flowiseai | 11 |
| drupal | 8 |
| axios | 7 |
| fasterxml | 4 |
| ash-project | 3 |
| craftcms | 3 |
| spring | 3 |
| budibase | 2 |
| djust-org | 2 |
| hoppscotch | 2 |
| middleapi | 2 |
| misp | 2 |
| payloadcms | 2 |
| red hat | 2 |
| a2ui-project | 1 |
