Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Weakness type CWE-488 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 9 | 8 | 0 |
▃▁▁▁▁▁▁▁▁▁▁▁▁▁▁▅▃█▃
2025-09 0 · 2025-10 0 · 2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 1 · 2026-07 4 · 2026-08 1
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-1247 | 8.3 | 53.0 | — | Io.quarkus:quarkus-rest: quarkus rest endpoint request parameter leakage due to shared … |
| CVE-2026-16498 | 10.0 | 26.0 | — | terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP sta… |
| CVE-2026-54311 | 6.0 | 24.4 | — | n8n: Merge Node SQL Mode Prototype Pollution |
| CVE-2026-16326 | 10.0 | 22.6 | — | consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP statel… |
| CVE-2026-46416 | 6.3 | 20.2 | — | Microsoft UFO shared WebSocket handler state causes cross-client response hijacking |
| CVE-2026-54497 | 6.8 | 16.5 | — | view_component: Reused Component Instances Retain Stale Render Context |
| CVE-2026-14621 | 1.3 | 15.5 | — | FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.… |
| CVE-2026-9831 | 6.3 | 7.0 | — | ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race… |
| CVE-2026-71850 | 4.8 | 6.1 | — | Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure |
| Vendor | CVEs |
|---|---|
| hashicorp | 2 |
| extreme networks | 1 |
| federatedai | 1 |
| honojs | 1 |
| microsoft | 1 |
| n8n-io | 1 |
| red hat | 1 |
| viewcomponent | 1 |