Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-92152 |
critical | 9.3 | 0.0067 | 2026-10-14 | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedde | |
CVE-2024-58400 |
high | 8.8 | 0.0042 | 2026-10-27 | llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and lla | |
CVE-2026-56770 |
high | 8.7 | 0.0058 | 2026-06-25 | libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when proce | |
CVE-2026-73564 |
high | 8.7 | 0.0052 | 2026-08-13 | frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/ | |
CVE-2026-114405 |
high | 8.7 | 0.0034 | 2026-10-21 | Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from | |
CVE-2026-116816 |
high | 8.5 | 0.0014 | 2026-10-27 | llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_pla | |
CVE-2026-56111 |
high | 8.3 | 0.0065 | 2026-06-24 | Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, | |
CVE-2026-13131 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-13132 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57264 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57265 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57266 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57267 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57268 |
high | 8.3 | 0.0045 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57269 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57270 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57271 |
high | 8.3 | 0.0037 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-57272 |
high | 8.3 | 0.0039 | 2026-07-02 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is | |
CVE-2026-107325 |
high | 8.2 | 0.0024 | 2026-10-08 | Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index | |
CVE-2026-65832 |
high | 8.2 | 0.0055 | 2026-08-17 | Deskflow is a keyboard and mouse sharing app. Prior to continuous build 1.26.0.299, a remote unauthe | |
CVE-2026-24238 |
high | 7.8 | 0.0021 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of | |
CVE-2026-64271 |
high | 7.8 | 0.0017 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: touchwin - reset the pac | |
CVE-2026-64272 |
high | 7.8 | 0.0017 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: mms114 - fix touch index | |
CVE-2026-64273 |
high | 7.8 | 0.0017 | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: iforce - bound the devic | |
CVE-2026-41643 |
high | 7.5 | 0.0054 | 2026-05-07 | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. | |
CVE-2026-14193 |
high | 7.5 | 0.0046 | 2026-07-01 | DVP80ES300T with Improper Validation of Array Index Vulnerability | |
CVE-2026-45799 |
high | 7.5 | 0.0073 | 2026-07-17 | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0 | |
CVE-2026-52856 |
high | 7.5 | 0.0061 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. | |
CVE-2026-93862 |
high | 7.2 | 0.0016 | 2026-10-27 | An out-of-bounds read vulnerability in the FireCluster Sync processing allows an attacker positioned | |
CVE-2026-70634 |
high | 7.2 | 0.0053 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionar | |
CVE-2026-116181 |
high | 7.1 | 0.0037 | 2026-10-25 | vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remot | |
CVE-2026-40251 |
high | 7.1 | 0.0041 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validatio | |
CVE-2026-32682 |
high | 7.1 | 0.0029 | 2026-06-17 | When NGINX Gateway Fabric is configured using GRPCRoutes, an authenticated, remote attacker with per | |
CVE-2026-50144 |
high | 7.1 | 0.0016 | 2026-07-15 | ncnn is a high-performance neural network inference framework optimized for the mobile platform. In | |
CVE-2026-70635 |
high | 7.1 | 0.0044 | 2026-08-06 | TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability th | |
CVE-2026-53792 |
high | 7.1 | 0.0031 | 2026-08-13 | rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching lo | |
CVE-2026-82947 |
high | 7.1 | 0.0017 | 2026-10-26 | SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicio | |
CVE-2026-116585 |
medium | 6.9 | 0.0026 | 2026-10-26 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards | |
CVE-2026-116731 |
medium | 6.9 | 0.0014 | 2026-10-26 | Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM() that a | |
CVE-2026-103672 |
medium | 6.9 | 0.0013 | 2026-10-20 | The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing D | |
CVE-2026-115722 |
medium | 6.9 | 0.0013 | 2026-10-23 | RPly through 1.1.4 contains an improper array index validation vulnerability in ply_read_header_prop | |
CVE-2023-31309 |
medium | 6.8 | 0.0011 | 2026-05-15 | Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pas | |
CVE-2026-115916 |
medium | 6.5 | 0.0031 | 2026-10-26 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, vllm/tokenizers/ | |
CVE-2026-82945 |
medium | 6.5 | 0.0017 | 2026-10-26 | SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a maliciou | |
CVE-2026-89319 |
medium | 6.3 | 0.0021 | 2026-10-23 | `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-he | |
CVE-2026-46377 |
medium | 6.2 | 0.0019 | 2026-07-16 | Dasel is a command-line tool and library for querying, modifying, and transforming data structures. | |
CVE-2026-113881 |
medium | 6.1 | 0.0036 | 2026-10-27 | A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access Enforcement process | |
CVE-2026-116590 |
medium | 5.9 | 0.0041 | 2026-10-26 | snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Pr | |
CVE-2026-34942 |
medium | 5.9 | 0.0035 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime's imple | |
CVE-2026-119143 |
medium | 5.9 | — | 2026-10-29 | Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability th |