Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-73411 |
medium | 6.3 | 0.0059 | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFuncti | |
CVE-2026-43971 |
medium | 6.3 | 0.0052 | 2026-08-18 | Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directi | |
CVE-2025-11712 |
medium | 6.1 | 0.0022 | 2025-10-14 | A malicious page could have used the type attribute of an OBJECT tag to override the default browser | |
CVE-2026-33436 |
medium | 6.1 | 0.0017 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. I | |
CVE-2026-40302 |
medium | 6.1 | 0.0021 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the | |
CVE-2026-39826 |
medium | 6.1 | 0.0037 | 2026-05-07 | If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a | |
CVE-2026-44311 |
medium | 6.1 | 0.0027 | 2026-06-22 | Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XS | |
CVE-2026-59895 |
medium | 6.1 | 0.0033 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 bef | |
CVE-2026-20136 |
medium | 6.0 | 0.0050 | 2026-04-15 | A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identi | |
CVE-2026-6058 |
medium | 5.7 | 0.0018 | 2026-04-21 | ** UNSUPPORTED WHEN ASSIGNED ** An improper encoding or escaping vulnerability in the CGI program of | |
CVE-2026-40483 |
medium | 5.4 | 0.0022 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor | |
CVE-2026-41318 |
medium | 5.4 | 0.0019 | 2026-04-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as refe | |
CVE-2026-116815 |
medium | 5.3 | 0.0023 | 2026-10-27 | OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows | |
CVE-2026-54287 |
medium | 5.3 | 0.0031 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-28898 |
medium | 5.3 | 0.0031 | 2026-06-25 | swift-nio-http2's HTTP/2-to-HTTP/1.1 codec did not validate pseudo-header values for control charact | |
CVE-2026-55442 |
medium | 5.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-44913 |
medium | 5.2 | 0.0065 | 2026-06-22 | Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache N | |
CVE-2026-44429 |
medium | 5.1 | 0.0017 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. | |
CVE-2026-46628 |
medium | 5.1 | 0.0029 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered | |
CVE-2026-73161 |
medium | 5.1 | 0.0040 | 2026-08-11 | Affected versions of cti-transmute improperly handle conversion-table values passed through the sear | |
CVE-2026-44972 |
medium | 5.0 | 0.0011 | 2026-05-27 | GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes a | |
CVE-2026-25932 |
medium | 4.8 | 0.0028 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticat | |
CVE-2026-40593 |
medium | 4.8 | 0.0020 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (U | |
CVE-2026-12047 |
medium | 4.8 | 0.0022 | 2026-06-19 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and | |
CVE-2026-50642 |
medium | 4.8 | 0.0023 | 2026-07-29 | diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff d | |
CVE-2026-112949 |
medium | 4.7 | 0.0034 | 2026-10-20 | Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 | |
CVE-2026-116582 |
medium | 4.7 | 0.0019 | 2026-10-26 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.strin | |
CVE-2026-66486 |
medium | 4.6 | 0.0018 | 2026-08-10 | GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing func | |
CVE-2026-44458 |
medium | 4.3 | 0.0020 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-40011 |
low | 3.7 | 0.0022 | 2026-06-25 | An attacker sending a large number of crafted DNS queries might be able to trigger a dynamic block b | |
CVE-2026-47175 |
low | 2.3 | 0.0030 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-47188 |
low | 2.3 | 0.0030 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-47206 |
low | 2.3 | 0.0036 | 2026-06-26 | Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragon | |
CVE-2026-73157 |
low | 2.3 | 0.0044 | 2026-08-11 | Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-b | |
CVE-2026-118256 |
low | 2.1 | 0.0048 | 2026-10-28 | Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-a | |
CVE-2026-6019 |
low | 2.1 | 0.0021 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript | |
CVE-2026-48485 |
low | 2.1 | 0.0032 | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the latest release suppresses mentio | |
CVE-2026-59727 |
low | 2.1 | 0.0039 | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a trans | |
CVE-2022-24682 |
— | — | 0.3093 | — | Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the | KEV |
CVE-2026-20245 |
— | — | 0.2532 | — | Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of o | KEV |