Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-49252 |
critical | 9.9 | 0.0047 | 2026-06-18 | deepstream is a server that allows clients and backend services to sync data, send messages and make | |
CVE-2026-40190 |
critical | 9.8 | 0.0031 | 2026-04-10 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, th | |
CVE-2026-57926 |
critical | 9.8 | 0.0034 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollut | |
CVE-2026-44789 |
critical | 9.4 | 0.0053 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen | |
CVE-2026-44791 |
critical | 9.4 | 0.0054 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen | |
CVE-2026-53609 |
critical | 9.1 | 0.0035 | 2026-06-12 | ApostropheCMS is an open-source Node.js content management system. In versions up to and including 4 | |
CVE-2026-48713 |
critical | 9.1 | 0.0051 | 2026-06-15 | Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when u | |
CVE-2026-48714 |
critical | 9.1 | 0.0051 | 2026-06-15 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti | |
CVE-2026-48170 |
critical | 9.1 | 0.0040 | 2026-08-07 | `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype pollution w | |
CVE-2026-114142 |
high | 8.8 | 0.0040 | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attac | |
CVE-2023-23917 |
high | 8.8 | 0.0098 | 2023-02-23 | A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker | |
CVE-2026-54639 |
high | 8.8 | 0.0036 | 2026-06-24 | Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulne | |
CVE-2021-48012 |
high | 8.8 | — | 2026-10-12 | fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify | |
CVE-2026-118649 |
high | 8.7 | — | 2026-10-28 | n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each wor | |
CVE-2026-18420 |
high | 8.7 | 0.0096 | 2026-08-20 | Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards a | |
CVE-2026-112309 |
high | 8.7 | 0.0040 | 2026-10-19 | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauth | |
CVE-2026-34621 |
high | 8.6 | 0.0723 | 2026-04-11 | Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code | KEV |
CVE-2026-34622 |
high | 8.6 | 0.0042 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Impr | |
CVE-2026-41690 |
high | 8.6 | 0.0031 | 2026-05-08 | 18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastif | |
CVE-2026-48795 |
high | 8.6 | 0.0055 | 2026-07-15 | AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisj | |
CVE-2026-107588 |
high | 8.4 | 0.0052 | 2026-10-21 | Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in V | |
CVE-2026-44483 |
high | 8.2 | 0.0036 | 2026-05-27 | RVF (formerly Remix Validated Form) provides easy form validation and state management for React. Fr | |
CVE-2026-46509 |
high | 8.2 | 0.0032 | 2026-05-28 | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is | |
CVE-2026-45325 |
high | 8.2 | 0.0046 | 2026-07-16 | Gestor de Oferta is a web application for managing mobility service offerings. Prior to 20260509.034 | |
CVE-2026-55388 |
high | 8.1 | 0.0048 | 2026-06-22 | piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's co | |
CVE-2026-110111 |
high | 7.7 | 0.0062 | 2026-10-13 | Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authent | |
CVE-2026-14893 |
high | 7.3 | 0.0033 | 2026-07-28 | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer comp | |
CVE-2026-54737 |
high | 7.3 | 0.0046 | 2026-07-31 | @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash d | |
CVE-2026-118249 |
high | 7.2 | — | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts bu | |
CVE-2026-118250 |
high | 7.2 | — | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3. | |
CVE-2026-54312 |
high | 7.2 | 0.0040 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with perm | |
CVE-2026-46681 |
high | 7.2 | 0.0036 | 2026-07-21 | @nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14. | |
CVE-2026-118678 |
high | 7.1 | — | 2026-10-28 | n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows | |
CVE-2026-59206 |
high | 7.1 | 0.0066 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authe | |
CVE-2026-72749 |
high | 7.1 | 0.0057 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fie | |
CVE-2026-71553 |
high | 7.1 | 0.0043 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api | |
CVE-2026-118247 |
medium | 6.9 | — | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and | |
CVE-2026-118248 |
medium | 6.9 | — | 2026-10-28 | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dash | |
CVE-2026-33993 |
medium | 6.9 | 0.0059 | 2026-03-27 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior | |
CVE-2026-6594 |
medium | 6.9 | 0.0034 | 2026-04-20 | A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing | |
CVE-2026-41238 |
medium | 6.9 | 0.0027 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 thr | |
CVE-2026-116674 |
medium | 6.5 | 0.0029 | 2026-10-27 | systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats | |
CVE-2026-71437 |
medium | 6.5 | 0.0050 | 2026-08-06 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and char | |
CVE-2026-73562 |
medium | 6.5 | 0.0050 | 2026-08-13 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to | |
CVE-2026-33994 |
medium | 6.3 | 0.0057 | 2026-03-27 | Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Starti | |
CVE-2026-34626 |
medium | 6.3 | 0.0034 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Impr | |
CVE-2026-54306 |
medium | 6.3 | 0.0028 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, a prototype pollutio | |
CVE-2026-54756 |
medium | 6.3 | 0.0046 | 2026-07-01 | Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities | |
CVE-2026-55886 |
medium | 6.3 | 0.0053 | 2026-07-01 | Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities | |
CVE-2026-56763 |
medium | 6.3 | 0.0027 | 2026-07-11 | Hono before 4.12.7 allows __proto__ key in parseBody with dot option enabled, permitting specially c |