Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54133 |
critical | 9.8 | 0.0044 | 2026-06-12 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem | |
CVE-2026-42810 |
critical | 9.4 | 0.0043 | 2026-05-04 | Apache Polaris accepts literal `*` characters in namespace and table names. When it later builds tem | |
CVE-2026-12048 |
critical | 9.3 | 0.0027 | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text retur | |
CVE-2026-56379 |
critical | 9.2 | 0.0164 | 2026-06-23 | ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG deco | |
CVE-2026-113867 |
critical | 9.1 | 0.0018 | 2026-10-20 | Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values f | |
CVE-2026-55570 |
critical | 9.0 | 0.0040 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape th | |
CVE-2026-102235 |
high | 8.8 | 0.0072 | 2026-10-13 | Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to exe | |
CVE-2026-35582 |
high | 8.8 | 0.0086 | 2026-04-18 | Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getComm | |
CVE-2026-44713 |
high | 8.8 | 0.0016 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, s | |
CVE-2026-47171 |
high | 8.8 | 0.0041 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-104368 |
high | 8.8 | — | 2026-10-30 | The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation | |
CVE-2026-35569 |
high | 8.7 | 0.0030 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-12044 |
high | 8.7 | 0.0071 | 2026-06-19 | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<descripti | |
CVE-2026-62184 |
high | 8.7 | 0.0056 | 2026-07-13 | luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IP | |
CVE-2026-55730 |
high | 8.7 | 0.0061 | 2026-07-24 | Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms | |
CVE-2026-59833 |
high | 8.6 | 0.0049 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, SiYuan renders note a | |
CVE-2026-113870 |
high | 8.6 | 0.0024 | 2026-10-21 | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation p | |
CVE-2026-33941 |
high | 8.2 | 0.0030 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 thr | |
CVE-2025-11713 |
high | 8.1 | 0.0029 | 2025-10-14 | Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into execut | |
CVE-2026-28907 |
high | 8.1 | 0.0030 | 2026-05-11 | The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7 | |
CVE-2026-49091 |
high | 8.0 | 0.0032 | 2026-07-01 | Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Inject | |
CVE-2026-113726 |
high | 7.8 | 0.0026 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash a | |
CVE-2026-113732 |
high | 7.8 | 0.0024 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActiva | |
CVE-2026-113725 |
high | 7.8 | 0.0019 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash a | |
CVE-2026-54699 |
high | 7.7 | 0.0074 | 2026-06-24 | Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15. | |
CVE-2026-55659 |
high | 7.7 | 0.0036 | 2026-07-10 | Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server- | |
CVE-2026-35534 |
high | 7.6 | 0.0017 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting | |
CVE-2026-34483 |
high | 7.5 | 0.0046 | 2026-04-09 | Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache | |
CVE-2026-33597 |
high | 7.5 | 0.0035 | 2026-04-22 | PRSD detection denial of service | |
CVE-2026-45011 |
high | 7.3 | 0.0027 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. Version 4.29.0 has a stored cross | |
CVE-2026-118257 |
high | 7.2 | 0.0027 | 2026-10-28 | Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-a | |
CVE-2026-40871 |
high | 7.2 | 0.0857 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026- | |
CVE-2026-63397 |
high | 7.1 | 0.0048 | 2026-07-16 | remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL sch | |
CVE-2026-114510 |
high | 7.1 | 0.0024 | 2026-10-22 | Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applic | |
CVE-2026-57210 |
high | 7.0 | 0.0031 | 2026-10-23 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-34479 |
medium | 6.9 | 0.0053 | 2026-04-10 | The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden b | |
CVE-2026-34480 |
medium | 6.9 | 0.0105 | 2026-04-10 | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , | |
CVE-2026-2404 |
medium | 6.9 | 0.0019 | 2026-04-14 | CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection | |
CVE-2026-53693 |
medium | 6.9 | 0.0028 | 2026-06-10 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several clie | |
CVE-2026-54364 |
medium | 6.9 | 0.0043 | 2026-07-30 | CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthentica | |
CVE-2026-50659 |
medium | 6.5 | 0.0074 | 2026-07-14 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing ov | |
CVE-2023-23599 |
medium | 6.5 | 0.0060 | 2023-06-02 | When copying a network request from the developer tools panel as a curl command the output was not b | |
CVE-2026-110910 |
medium | 6.3 | 0.0029 | 2026-10-27 | ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without | |
CVE-2026-34481 |
medium | 6.3 | 0.0069 | 2026-04-10 | Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout. | |
CVE-2026-40021 |
medium | 6.3 | 0.0077 | 2026-04-10 | Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#lay | |
CVE-2026-40023 |
medium | 6.3 | 0.0050 | 2026-04-10 | Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayou | |
CVE-2026-47173 |
medium | 6.3 | 0.0033 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-49844 |
medium | 6.3 | 0.0060 | 2026-07-10 | Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache | |
CVE-2026-64647 |
medium | 6.3 | 0.0032 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15 | |
CVE-2026-54705 |
medium | 6.3 | 0.0026 | 2026-07-29 | MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to esc |