Weakness of the WeekWeekly
Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Updated 11 October 2026 · Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 471. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
Why it matters
Which weakness types dominate this week's disclosures tells you where new exposure is concentrating, and which classes of defect to expect more of in the products you run.
What to do
- Security leaders. If this week's leading weakness maps to your stack, ask whether your testing catches that class before release.
- Lean IT orgs. Recurring weakness classes are worth a one-time hardening pass, not just per-CVE patching.
- MSPs. Point clients to the weakness classes trending this week as a proactive review prompt.
Our take
Naming the week's dominant weakness type turns a stream of CVEs into a pattern you can actually design against.
Earlier issues
Past states of this signal, most recent first.
11 October 2026 Weakness of the week: CWE-862 (Missing Authorization) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-862 (Missing Authorization), tagged on 342. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
06 October 2026 Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 412. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
01 October 2026 Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 327. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
26 September 2026 Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 254. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
21 September 2026 Weakness of the week: CWE-284 (Improper Access Control) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-284 (Improper Access Control), tagged on 388. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
16 September 2026 Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 249. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
11 September 2026 Weakness of the week: CWE-122 (Heap-based Buffer Overflow) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-122 (Heap-based Buffer Overflow), tagged on 346. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
06 September 2026 Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 214. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
01 September 2026 Weakness of the week: CWE-284 (Improper Access Control) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-284 (Improper Access Control), tagged on 192. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
27 August 2026 Weakness of the week: CWE-79 (Cross-site Scripting) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), tagged on 187. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
22 August 2026 Weakness of the week: CWE-284 (Improper Access Control) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-284 (Improper Access Control), tagged on 558. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.
17 August 2026 Weakness of the week: CWE-862 (Missing Authorization) leads this week's new CVEs
Timeframe: CVEs published in the last 7 days
Across CVEs published in the last 7 days, the most common weakness type is CWE-862 (Missing Authorization), tagged on 192. The chart ranks the week's top weakness classes — the flaw patterns showing up most in fresh disclosures right now.