Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-93
Weakness type CWE-93 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 118 | 114 | 1 |
Monthly trend
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▄▇▅██▅
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 1 · 2026-05 10 · 2026-06 22 · 2026-07 14 · 2026-08 26 · 2026-09 26 · 2026-10 15
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-61884 | 7.5 | 99.9 | KEV | Oracle E-Business Suite |
| CVE-2019-9740 | 6.1 | 92.6 | — | — |
| CVE-2019-9947 | 6.1 | 92.5 | — | — |
| CVE-2026-72590 | 9.8 | 80.9 | — | alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter |
| CVE-2026-82854 | 9.3 | 80.2 | — | Nodemailer before 8.0.3 SMTP Command Injection via envelope.size |
| CVE-2026-15429 | 5.1 | 71.9 | — | Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v |
| CVE-2026-42258 | 5.8 | 69.0 | — | net-imap: Command Injection via unvalidated Symbol inputs |
| CVE-2026-42578 | 2.9 | 66.5 | — | Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation |
| CVE-2026-12357 | 7.2 | 64.8 | — | Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution V… |
| CVE-2026-82853 | 6.9 | 63.2 | — | Nodemailer before 8.0.5 SMTP Command Injection via CRLF |
| CVE-2026-111222 | 7.5 | 61.5 | — | Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting |
| CVE-2026-111221 | 7.5 | 60.7 | — | Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection |
| CVE-2026-57281 | 7.5 | 59.8 | — | — |
| CVE-2026-111219 | 7.5 | 58.6 | — | Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username |
| CVE-2026-47240 | 5.8 | 56.9 | — | Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument |
| CVE-2026-111227 | 5.1 | 56.2 | — | Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php |
| CVE-2026-111228 | 5.1 | 56.2 | — | Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php |
| CVE-2026-77550 | 10.0 | 55.9 | — | — |
| CVE-2026-84372 | 9.8 | 53.3 | — | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined c… |
| CVE-2026-111220 | 8.6 | 53.3 | — | Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid |
