Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-681
Weakness type CWE-681 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 28 | 28 | 0 |
Monthly trend
▂▂▂▃▃▄█▁
2026-03 1 · 2026-04 1 · 2026-05 1 · 2026-06 4 · 2026-07 4 · 2026-08 5 · 2026-09 12 · 2026-10 0
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-4602 | 7.7 | 57.6 | — | — |
| CVE-2026-26178 | 8.8 | 55.7 | — | Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability |
| CVE-2026-69438 | 8.1 | 51.8 | — | Microsoft JScript Remote Code Execution Vulnerability |
| CVE-2026-77412 | 8.9 | 42.4 | — | RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client |
| CVE-2026-53923 | 5.3 | 39.5 | — | vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer ove… |
| CVE-2026-55768 | 8.7 | 38.6 | — | GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a… |
| CVE-2026-55123 | 7.8 | 38.2 | — | Microsoft PowerPoint Remote Code Execution Vulnerability |
| CVE-2026-82522 | 5.3 | 32.7 | — | libjxl < 0.12.0 Container Box Parser Integer Underflow via 32-bit Size Truncation |
| CVE-2026-6426 | 4.4 | 31.3 | — | Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds a… |
| CVE-2026-19879 | 5.3 | 31.1 | — | Io.undertow/undertow: undertow: http response header integrity issue due to character t… |
| CVE-2026-88368 | 7.5 | 30.7 | — | — |
| CVE-2026-88362 | 7.5 | 25.6 | — | — |
| CVE-2026-50402 | 7.8 | 24.4 | — | NTFS Elevation of Privilege Vulnerability |
| CVE-2026-84963 | 6.3 | 21.7 | — | Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BS… |
| CVE-2026-9143 | 6.3 | 20.7 | — | Incorrect Conversion between Numeric Types in NI grpc-device due to missing range check… |
| CVE-2026-88367 | 6.5 | 14.3 | — | — |
| CVE-2026-53466 | 6.5 | 11.4 | — | ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflow |
| CVE-2026-24192 | 7.8 | 9.6 | — | — |
| CVE-2026-82457 | 8.5 | 6.9 | — | su-exec through 0.3 Privilege Escalation via Numeric User ID |
| CVE-2026-75145 | 5.8 | 4.4 | — | FFmpeg Integer Narrowing Conversion OOB Memory Access in AV1 RTP Packetizer |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| microsoft | 4 |
| mongodb | 3 |
| nvidia | 3 |
| red hat | 2 |
| allinurl | 1 |
| ffmpeg | 1 |
| freebsd | 1 |
| imagemagick | 1 |
| libjxl | 1 |
| linux | 1 |
| ncopa | 1 |
| ni | 1 |
| rabbitmq | 1 |
| samsung mobile | 1 |
| vllm-project | 1 |
