Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Weakness type CWE-917 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 14 | 13 | 1 |
▂▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▁▃▂█▃▁
2025-09 0 · 2025-10 0 · 2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 0 · 2026-04 2 · 2026-05 1 · 2026-06 7 · 2026-07 2 · 2026-08 0
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2021-44228 | 10.0 | 100.0 | KEV | Apache Log4j2 |
| CVE-2026-40477 | 9.0 | 55.3 | — | Improper restriction of the scope of accessible objects in Thymeleaf expressions |
| CVE-2026-40478 | 9.0 | 52.7 | — | Improper neutralization of specific syntax patterns for unauthorized expressions in Thy… |
| CVE-2026-57281 | 7.5 | 45.8 | — | — |
| CVE-2026-44209 | 7.5 | 43.1 | — | Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI |
| CVE-2026-24737 | 8.1 | 42.3 | — | jsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript Exec… |
| CVE-2026-52439 | 9.8 | 41.7 | — | — |
| CVE-2026-65591 | 8.9 | 38.9 | — | n8n before 1.123.64 Sanitizer Bypass Remote Code Execution |
| CVE-2026-11561 | 9.8 | 37.5 | — | SSTI in Soagen Informatics' Apinizer |
| CVE-2026-8888 | 7.5 | 36.1 | — | CVE-2026-8888 |
| CVE-2026-41729 | 8.1 | 32.6 | — | Spring Data REST SpEL Injection via Map Key in JSON Patch |
| CVE-2026-41717 | 8.1 | 25.8 | — | Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding |
| CVE-2026-40985 | 6.4 | 13.4 | — | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-41719 | 6.4 | 11.0 | — | Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator |
| Vendor | CVEs |
|---|---|
| spring | 4 |
| thymeleaf | 2 |
| apache | 1 |
| jenkins project | 1 |
| masci | 1 |
| n8n-io | 1 |
| parallax | 1 |
| securly | 1 |
| soagen informatics technologies software and consulting | 1 |