Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (837)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54466 |
critical | 9.2 | 0.0038 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame forma | |
CVE-2026-42216 |
high | 8.8 | 0.0046 | 2026-05-07 | OpenEXR provides the specification and reference implementation of the EXR file format, an image sto | |
CVE-2026-114597 |
high | 8.7 | 0.0030 | 2026-10-27 | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a | |
CVE-2026-3868 |
high | 8.7 | 0.0037 | 2026-04-27 | An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa | |
CVE-2026-41035 |
high | 7.8 | 0.0039 | 2026-04-16 | In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, | |
CVE-2026-114646 |
medium | 6.9 | 0.0026 | 2026-10-22 | A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# D | |
CVE-2026-105960 |
medium | 6.8 | 0.0011 | 2026-10-20 | PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. Th | |
CVE-2026-40199 |
medium | 6.5 | 0.0031 | 2026-04-10 | Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow | |
CVE-2026-5265 |
medium | 6.5 | 0.0063 | 2026-04-24 | When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a por | |
CVE-2026-5766 |
medium | 6.3 | 0.0042 | 2026-05-05 | An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or u | |
CVE-2026-116013 |
medium | 6.3 | 0.0029 | 2026-10-24 | OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_sec | |
CVE-2026-119279 |
medium | 5.9 | — | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases | |
CVE-2026-119276 |
medium | 5.9 | — | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases | |
CVE-2026-119277 |
medium | 5.9 | — | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases | |
CVE-2026-33936 |
medium | 5.3 | 0.0049 | 2026-03-27 | The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with s | |
CVE-2026-6432 |
medium | 5.3 | 0.0060 | 2026-06-25 | Improper bounds validation in the ZAP command parser of EmberZNet SDK versions 8.0.0 through 9.1.1 ( | |
CVE-2026-60060 |
medium | 5.1 | 0.0032 | 2026-07-17 | Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin | |
CVE-2026-47692 |
medium | 4.3 | 0.0022 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 u | |
CVE-2026-115794 |
low | 2.3 | — | 2026-10-29 | P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable par | |
CVE-2026-116531 |
— | — | 0.0029 | 2026-10-28 | HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies | |
CVE-2026-5367 |
— | — | 0.0087 | 2026-04-24 | A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynami | |
CVE-2026-33846 |
— | — | 0.0126 | 2026-05-04 | A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTL |