Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-943
Weakness type CWE-943 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 79 | 79 | 0 |
Monthly trend
▁▄▃▇█▅
2026-05 1 · 2026-06 10 · 2026-07 6 · 2026-08 23 · 2026-09 26 · 2026-10 13
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-62906 | 7.4 | 59.6 | — | Microsoft Discovery Studio Information Disclosure Vulnerability |
| CVE-2026-53674 | 7.1 | 50.6 | — | BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution |
| CVE-2026-10698 | 7.2 | 49.8 | — | Table scope bypass vulnerability in custom reports |
| CVE-2026-46591 | 8.2 | 44.8 | — | Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties heade… |
| CVE-2026-54350 | 9.8 | 44.1 | — | Budibase: Anonymous NoSQL operator injection via published-app query templates |
| CVE-2026-93760 | 8.3 | 43.7 | — | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator … |
| CVE-2026-55253 | 7.7 | 43.7 | — | LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-ten… |
| CVE-2026-40141 | 8.5 | 43.5 | — | High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support … |
| CVE-2026-45689 | 9.1 | 43.3 | — | Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary Use… |
| CVE-2026-77070 | 7.1 | 42.3 | — | n8n before 1.123.69 NoSQL Injection via MongoDB Node |
| CVE-2026-81914 | 4.3 | 42.2 | — | Apache Airflow Google provider: Google Drive query injection via unescaped file and fol… |
| CVE-2026-76316 | 8.8 | 41.8 | — | Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise |
| CVE-2026-45688 | 9.1 | 41.0 | — | Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAM… |
| CVE-2026-44840 | 7.5 | 40.9 | — | Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query |
| CVE-2026-81525 | 8.6 | 40.7 | — | Cross-tenant database retargeting via dot/NUL injection in namespace strings in the PHP… |
| CVE-2026-88031 | 6.1 | 40.0 | — | GridFS data deletion via query-operator injection in file IDs in the MongoDB Go Driver |
| CVE-2026-88024 | 6.1 | 39.7 | — | GridFS data disclosure and deletion via query-operator injection in file IDs in the Mon… |
| CVE-2026-88025 | 6.1 | 39.7 | — | GridFS data disclosure and deletion via query-operator injection in file IDs in the Mon… |
| CVE-2026-91937 | 8.7 | 39.3 | — | Flowise before 3.1.4 NoSQL Injection via sessionId |
| CVE-2026-63138 | 6.5 | 38.8 | — | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to In… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| mongodb | 19 |
| splunk | 8 |
| langchain-ai | 4 |
| n8n-io | 4 |
| spring | 4 |
| tryghost | 4 |
| ash-project | 3 |
| budibase | 3 |
| makeplane | 3 |
| 4turesearchdata | 2 |
| @langchain | 2 |
| apache | 2 |
| dgraph-io | 2 |
| progress | 2 |
| rocketchat | 2 |
