Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42744 |
medium | 6.5 | 0.0021 | 2026-05-27 | Improper Validation of Specified Quantity in Input vulnerability in Ads by WPQuads Ads by WPQuads qu | |
CVE-2026-3676 |
medium | 6.5 | 0.0040 | 2026-05-27 | IBM Cloud APM, Base Private 8.1.4 and IBM Cloud APM, Advanced Private 8.1.4 IBM Db2 for Linux, UNIX | |
CVE-2026-11906 |
medium | 6.5 | 0.0042 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 C | |
CVE-2026-57364 |
medium | 6.5 | 0.0035 | 2026-07-13 | Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Ins | |
CVE-2026-10822 |
medium | 6.5 | 0.0038 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid d | |
CVE-2026-19517 |
medium | 6.5 | 0.0036 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Thr | |
CVE-2026-19518 |
medium | 6.5 | 0.0036 | 2026-08-11 | Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allo | |
CVE-2026-66679 |
medium | 6.5 | 0.0035 | 2026-08-18 | Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions. | |
CVE-2026-115906 |
medium | 6.5 | 0.0015 | 2026-10-26 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9 | |
CVE-2024-36346 |
medium | 6.0 | 0.0013 | 2025-09-06 | Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker | |
CVE-2026-115382 |
medium | 5.9 | 0.0028 | 2026-10-22 | Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-service vulnerability in | |
CVE-2026-119186 |
medium | 5.9 | — | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2026-59997 |
medium | 5.4 | 0.0018 | 2026-07-08 | internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, whi | |
CVE-2026-2403 |
medium | 5.3 | 0.0017 | 2026-04-14 | CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Ev | |
CVE-2026-6915 |
medium | 5.3 | 0.0017 | 2026-04-29 | An authorization flaw in the user management command could allow an authenticated user to make limit | |
CVE-2026-7254 |
medium | 5.3 | 0.0024 | 2026-05-27 | IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticate | |
CVE-2026-42657 |
medium | 5.3 | 0.0022 | 2026-06-15 | Unauthenticated Other Vulnerability Type in Contest Gallery <= 28.1.7 versions. | |
CVE-2026-71394 |
medium | 5.3 | 0.0044 | 2026-08-10 | GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in | |
CVE-2026-9801 |
medium | 4.9 | 0.0048 | 2026-05-28 | A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator | |
CVE-2026-11596 |
medium | 4.7 | 0.0024 | 2026-06-10 | In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionali | |
CVE-2026-59930 |
medium | 4.3 | 0.0019 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and T | |
CVE-2026-44459 |
low | 3.8 | 0.0022 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-53540 |
low | 3.7 | 0.0034 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not v | |
CVE-2026-47329 |
low | 3.3 | 0.0009 | 2026-05-28 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the nam | |
CVE-2026-12755 |
low | 2.7 | 0.0037 | 2026-06-25 | Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 throug | |
CVE-2026-57053 |
low | 2.5 | 0.0014 | 2026-06-23 | GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs | |
CVE-2026-0428 |
low | 1.8 | 0.0010 | 2026-05-15 | Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed D | |
CVE-2026-114349 |
— | — | 0.0023 | 2026-10-28 | When a broker decodes a compressed record batch, the per-record decoder reads a declared body size f | |
CVE-2010-3904 |
— | — | 0.1586 | — | Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (R | KEV |