Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-98
Weakness type CWE-98 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 225 | 220 | 2 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▂█▃▃▂▃
2025-11 1 · 2025-12 1 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 10 · 2026-06 102 · 2026-07 36 · 2026-08 22 · 2026-09 18 · 2026-10 32
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-68645 | 8.8 | 98.9 | KEV | Synacor Zimbra Collaboration Suite (ZCS) |
| CVE-2026-87902 | 8.1 | 98.6 | KEV | — |
| CVE-2026-85200 | 7.5 | 88.1 | — | GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion |
| CVE-2026-12227 | 9.8 | 86.6 | — | Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via '… |
| CVE-2026-44177 | 8.8 | 77.8 | — | Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup |
| CVE-2024-14002 | 7.1 | 69.7 | — | Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis |
| CVE-2026-13080 | 6.6 | 67.9 | — | WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' … |
| CVE-2026-17605 | 6.6 | 67.9 | — | Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticate… |
| CVE-2026-8134 | 9.4 | 65.5 | — | Concrete CMS 9.5.0 and below is vulnerable to Authenticated RCE via Composer customTemp… |
| CVE-2026-103367 | 8.1 | 62.4 | — | ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Para… |
| CVE-2026-104909 | 8.1 | 62.4 | — | Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter |
| CVE-2025-32151 | 8.8 | 61.2 | — | WordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability |
| CVE-2026-14280 | 6.6 | 61.0 | — | Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'db… |
| CVE-2026-15338 | 7.5 | 60.8 | — | LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File … |
| CVE-2026-7515 | 9.8 | 60.3 | — | BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style |
| CVE-2026-9559 | 9.9 | 59.8 | — | — |
| CVE-2026-27555 | 8.8 | 58.6 | — | Local File Inclusion in /index.php/ajax/get_iodd_port_info |
| CVE-2026-27556 | 8.8 | 58.6 | — | Local File Inclusion in /index.php/ajax/save_iodd_parameters |
| CVE-2026-9662 | 8.1 | 58.4 | — | Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' … |
| CVE-2026-75963 | 7.5 | 58.1 | — | Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_p… |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| themerex | 54 |
| elated-themes | 12 |
| select-themes | 9 |
| axiomthemes | 8 |
| kutethemes | 7 |
| mikado-themes | 6 |
| cocobasic | 5 |
| edge-themes | 4 |
| arraytics | 3 |
| invoiceplane | 3 |
| stylemixthemes | 3 |
| thememove | 3 |
| uxper | 3 |
| webgeniuslab | 3 |
| ancorathemes | 2 |
