Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-35157 |
critical | 9.8 | 0.0032 | 2026-05-11 | Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a | |
CVE-2026-47705 |
critical | 9.6 | 0.0056 | 2026-08-11 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the result ex | |
CVE-2023-47534 |
high | 8.8 | 0.0105 | 2024-03-12 | A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS | |
CVE-2026-5242 |
high | 8.8 | 0.0030 | 2026-06-15 | Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy | |
CVE-2023-54348 |
high | 8.7 | 0.0035 | 2026-05-05 | ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject | |
CVE-2025-51735 |
high | 7.5 | 0.0036 | 2025-11-28 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. | |
CVE-2026-116647 |
high | 7.1 | 0.0024 | 2026-10-27 | Tanium addressed an improper output sanitization vulnerability in Comply. | |
CVE-2026-116649 |
high | 7.1 | 0.0020 | 2026-10-27 | Tanium addressed an improper output sanitization vulnerability in Enforce. | |
CVE-2026-54243 |
medium | 6.1 | 0.0034 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, | |
CVE-2026-64955 |
medium | 6.1 | 0.0036 | 2026-08-12 | When Microsoft Excel imports a CSV file, it executes cells beginning with certain characters as form | |
CVE-2026-102799 |
medium | 5.3 | 0.0029 | 2026-10-28 | Joomla Extension - icagenda.com - CSV formula injection in the registrations export in iCagenda 3.5. | |
CVE-2026-39424 |
medium | 5.3 | 0.0037 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, the chat export fe | |
CVE-2026-67187 |
medium | 5.1 | 0.0017 | 2026-10-28 | Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnera | |
CVE-2026-65875 |
medium | 5.1 | 0.0026 | 2026-08-03 | BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user | |
CVE-2026-18738 |
medium | 5.1 | 0.0049 | 2026-08-03 | Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauth | |
CVE-2026-55452 |
medium | 4.8 | 0.0043 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the | |
CVE-2026-46672 |
medium | 4.6 | 0.0018 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled C | |
CVE-2026-86020 |
medium | 4.6 | 0.0015 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-14846 |
medium | 4.5 | 0.0043 | 2026-07-13 | In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of e | |
CVE-2026-50179 |
medium | 4.2 | 0.0029 | 2026-07-07 | Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in |