Grouping the 1,748 CISA KEV entries by weakness type, memory safety flaws appear on 377 entries (22%), injection on 302 (17%) and authentication or access control flaws on 224 (13%). Memory safety peaked in 2022 and has fallen, while authentication flaws are the largest share of any year so far in 2026.
Method
We downloaded the KEV JSON on 19 October 2026 (version 2026.10.16). Each entry lists zero or more CWE identifiers in its cwes field. We built three groups by hand and counted an entry once per group if any of its CWEs fell in it.
- Memory safety: CWE-787, 416, 119, 122, 125, 120, 121, 190, 415, 476, 123, 126, 401, 763, 762 and 824.
- Injection: CWE-78, 77, 94, 89, 79, 74, 917, 95 and 91.
- Authentication and access control: CWE-287, 306, 862, 863, 284, 288, 290, 798, 522, 269, 259, 639, 285, 250, 295 and 345.
The grouping is our judgment. A different list would shift the numbers, and an entry can sit in more than one group, so the three counts do not add up to a whole.
The whole catalog
| Group | Entries | Share of 1,748 |
|---|---|---|
| Memory safety | 377 | 22% |
| Injection | 302 | 17% |
| Authentication and access control | 224 | 13% |
| Path traversal or file upload | 122 | 7% |
| Deserialization (CWE-502) | 71 | 4% |
| No CWE listed | 175 | 10% |
The single most common CWE codes are CWE-20 improper input validation (119 entries), CWE-78 OS command injection (111), CWE-787 out of bounds write (105), CWE-416 use after free (93) and CWE-119 buffer errors (88).
How the mix has moved
| Year added | Entries | Memory | Injection | Authentication |
|---|---|---|---|---|
| 2022 | 555 | 148 (27%) | 77 (14%) | 36 (6%) |
| 2023 | 187 | 46 (25%) | 39 (21%) | 30 (16%) |
| 2024 | 186 | 24 (13%) | 42 (23%) | 32 (17%) |
| 2025 | 245 | 42 (17%) | 46 (19%) | 36 (15%) |
| 2026 | 264 | 38 (14%) | 50 (19%) | 56 (21%) |
Two things stand out. Memory safety fell from about a quarter of additions in 2022 and 2023 to roughly 13% to 17% since. And authentication flaws, which were 6% of 2022 additions, are 21% of 2026 additions so far.
One caution on 2022: the early catalog absorbed a backlog of older Windows, Office and browser bugs, which are mostly memory flaws. That probably inflates the early memory share.
What it means for a team
Memory flaws still matter, but the recent additions lean toward flaws that let an attacker skip login or run a command through a web or management interface. For code you write, that points at input handling and access checks on every route. For products you run, it points at keeping management interfaces off the open internet and patching them quickly.
If you use these shares to decide what to scan for, remember that KEV only lists flaws with known exploitation. It tells you what attackers used, not every weakness that exists.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Run the scan and look at which findings fall under injection and access control.
Quick check
Does a CWE group tell me which flaws will be exploited next?
No. It describes the entries already in the catalog. Use it to guide what to review, not to forecast.
Why is the no-CWE count 175?
Some entries, mostly older ones, have no weakness code recorded in the catalog data.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).
Last reviewed: 19 October 2026.
