Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-917
Weakness type CWE-917 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 25 | 19 | 6 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▂▁▁▁▂▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▃▃▂█▃▁▃▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 2 · 2026-04 2 · 2026-05 1 · 2026-06 6 · 2026-07 2 · 2026-08 0 · 2026-09 2 · 2026-10 3
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-26084 | 9.8 | 100.0 | KEV | Atlassian Confluence Server and Data Center |
| CVE-2022-26134 | 9.8 | 100.0 | KEV | Atlassian Confluence Server/Data Center |
| CVE-2021-45046 | 9.0 | 100.0 | KEV | Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a… |
| CVE-2020-10199 | 8.8 | 99.9 | KEV | Sonatype Nexus Repository |
| CVE-2020-17530 | 9.8 | 99.9 | KEV | Apache Struts |
| CVE-2010-1871 | 8.8 | 99.7 | KEV | Red Hat JBoss Seam 2 |
| CVE-2026-40478 | 9.0 | 67.8 | — | Improper neutralization of specific syntax patterns for unauthorized expressions in Thy… |
| CVE-2026-104711 | 9.8 | 67.5 | — | Apache Struts: OGNL injection in the legacy RESTful action mapper |
| CVE-2026-40477 | 9.0 | 60.4 | — | Improper restriction of the scope of accessible objects in Thymeleaf expressions |
| CVE-2026-52439 | 9.8 | 59.8 | — | — |
| CVE-2026-33938 | 8.1 | 57.2 | — | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block |
| CVE-2026-44209 | 7.5 | 53.6 | — | Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI |
| CVE-2026-65591 | 8.9 | 52.0 | — | n8n before 1.123.64 Sanitizer Bypass Remote Code Execution |
| CVE-2026-8888 | 7.5 | 47.7 | — | CVE-2026-8888 |
| CVE-2026-24737 | 8.1 | 47.5 | — | jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Exec… |
| CVE-2026-11561 | 9.8 | 37.6 | — | SSTI in Soagen Informatics' Apinizer |
| CVE-2026-91145 | 7.1 | 35.1 | — | Activiti through 7.1.0.M6 Expression Injection via Mail Task |
| CVE-2026-41717 | 8.1 | 34.9 | — | Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding |
| CVE-2026-41729 | 8.1 | 32.8 | — | Spring Data REST SpEL Injection via Map Key in JSON Patch |
| CVE-2026-108334 | 7.4 | 24.1 | — | Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-… |
