Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-44727 |
critical | 9.3 | 0.0044 | 2026-06-22 | Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handle | |
CVE-2026-114125 |
high | 8.6 | 0.0039 | 2026-10-21 | Storybook is a frontend workshop for building user interface components and pages in isolation. From | |
CVE-2026-109290 |
high | 8.4 | 0.0031 | 2026-10-12 | Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPre | |
CVE-2026-58595 |
high | 8.1 | 0.0069 | 2026-07-14 | Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unautho | |
CVE-2026-60370 |
high | 7.5 | 0.0033 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-12348 |
high | 7.4 | 0.0032 | 2026-06-17 | Address bar spoofing in Arc Search for Android allows a remote attacker to display a trusted domain | |
CVE-2026-18534 |
high | 7.4 | 0.0034 | 2026-08-18 | ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated | |
CVE-2026-47723 |
high | 7.1 | 0.0053 | 2026-07-23 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v | |
CVE-2026-77062 |
medium | 6.9 | 0.0052 | 2026-10-26 | The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed th | |
CVE-2026-16397 |
medium | 6.5 | 0.0030 | 2026-07-21 | Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fix | |
CVE-2026-74951 |
medium | 6.5 | 0.0027 | 2026-08-18 | Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | |
CVE-2026-74980 |
medium | 6.5 | 0.0027 | 2026-08-18 | Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed i | |
CVE-2026-67079 |
medium | 6.4 | — | 2026-10-28 | HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed t | |
CVE-2026-40957 |
medium | 6.1 | 0.0043 | 2026-07-15 | o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior | |
CVE-2023-25730 |
medium | 5.4 | 0.0055 | 2023-06-02 | A background script invoking <code>requestFullscreen</code> and then blocking the main thread could | |
CVE-2026-12322 |
medium | 5.4 | 0.0021 | 2026-06-16 | Clickjacking issue in the Widget: Gtk component. This vulnerability was fixed in Firefox 152 and Thu | |
CVE-2026-12323 |
medium | 5.4 | 0.0017 | 2026-06-16 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Th | |
CVE-2026-14142 |
medium | 5.4 | 0.0021 | 2026-06-30 | Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote | |
CVE-2026-28971 |
medium | 4.3 | 0.0030 | 2026-05-11 | The issue was addressed with improved UI handling. This issue is fixed in Safari 26.5, iOS 26.5 and | |
CVE-2026-14110 |
medium | 4.3 | 0.0024 | 2026-06-30 | Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote at | |
CVE-2026-21785 |
medium | 4.0 | 0.0015 | 2026-05-27 | A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10 | |
CVE-2026-44762 |
low | 3.7 | 0.0019 | 2026-08-11 | SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) confi | |
CVE-2026-59791 |
low | 3.5 | 0.0023 | 2026-07-10 | In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible | |
CVE-2026-8022 |
low | 3.1 | 0.0015 | 2026-05-06 | Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attac | |
CVE-2026-43688 |
— | — | 0.0016 | 2026-09-14 | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 2 | |
CVE-2026-86911 |
— | — | 0.0015 | 2026-09-14 | This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27 |