Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-55486 |
critical | 9.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-41683 |
high | 8.6 | 0.0033 | 2026-05-08 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti | |
CVE-2026-43870 |
high | 7.3 | 0.0038 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversa | |
CVE-2026-9658 |
high | 7.3 | 0.0023 | 2026-05-28 | Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections | |
CVE-2026-39971 |
high | 7.2 | 0.0026 | 2026-04-15 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending funct | |
CVE-2026-50188 |
medium | 6.9 | 0.0044 | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins | |
CVE-2025-71381 |
medium | 6.9 | 0.0029 | 2026-06-30 | Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the mi | |
CVE-2026-50576 |
medium | 6.8 | 0.0049 | 2026-08-18 | ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to | |
CVE-2026-7010 |
medium | 6.5 | 0.0023 | 2026-05-11 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control fiel | |
CVE-2026-50630 |
medium | 6.5 | 0.0037 | 2026-06-12 | A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the | |
CVE-2023-26142 |
medium | 6.1 | 0.0052 | 2023-09-12 | All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input | |
CVE-2026-63771 |
medium | 6.0 | 0.0043 | 2026-07-20 | Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate c | |
CVE-2022-42472 |
medium | 5.4 | 0.0046 | 2023-02-16 | A improper neutralization of crlf sequences in http headers ('http response splitting') vulnerabilit | |
CVE-2026-49214 |
medium | 5.3 | 0.0019 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did | |
CVE-2026-66746 |
medium | 5.3 | 0.0034 | 2026-07-28 | Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote att | |
CVE-2026-55766 |
medium | 4.8 | 0.0023 | 2026-06-23 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/p | |
CVE-2026-54163 |
medium | 4.7 | 0.0021 | 2026-07-17 | secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secu | |
CVE-2026-42874 |
low | 3.7 | 0.0022 | 2026-05-11 | Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method do | |
CVE-2026-34514 |
low | 2.7 | 0.0033 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-34519 |
low | 2.7 | 0.0030 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-34520 |
low | 2.7 | 0.0048 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-50269 |
low | 2.7 | 0.0053 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att | |
CVE-2026-112880 |
low | 2.1 | 0.0019 | 2026-10-26 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulner |