Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-116588 |
high | 8.7 | 0.0047 | 2026-10-26 | Datadog dd-trace-py is the Datadog Python APM client. From 1.5.0 until 3.19.9 and 4.15.6, the defaul | |
CVE-2026-116693 |
high | 8.7 | 0.0045 | 2026-10-27 | dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_ | |
CVE-2026-118686 |
high | 8.7 | 0.0035 | 2026-10-28 | EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the | |
CVE-2026-0621 |
high | 8.7 | 0.0044 | 2026-01-05 | Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression deni | |
CVE-2026-33079 |
high | 8.7 | 0.0059 | 2026-05-06 | In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service | |
CVE-2026-47138 |
high | 8.7 | 0.0058 | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node. | |
CVE-2026-49851 |
high | 8.7 | 0.0052 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerabl | |
CVE-2026-55574 |
high | 8.7 | 0.0058 | 2026-07-06 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24. | |
CVE-2026-57584 |
high | 8.7 | 0.0053 | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC applicat | |
CVE-2026-48801 |
high | 8.7 | 0.0039 | 2026-07-14 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.proto | |
CVE-2026-71190 |
high | 8.7 | 0.0084 | 2026-08-05 | In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expressi | |
CVE-2026-54284 |
high | 8.7 | 0.0033 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction an | |
CVE-2026-72818 |
high | 8.7 | 0.0074 | 2026-08-20 | The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and app | |
CVE-2026-115349 |
high | 8.7 | 0.0034 | 2026-10-22 | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability i | |
CVE-2026-115728 |
high | 8.7 | 0.0047 | 2026-10-23 | @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability | |
CVE-2026-68749 |
high | 8.2 | 0.0080 | 2026-08-06 | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ | |
CVE-2026-118037 |
high | 7.5 | 0.0027 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recur | |
CVE-2026-116795 |
high | 7.5 | 0.0046 | 2026-10-28 | RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. | |
CVE-2023-22792 |
high | 7.5 | 0.0169 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Sp | |
CVE-2023-22795 |
high | 7.5 | 0.0228 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the | |
CVE-2023-22796 |
high | 7.5 | 0.0171 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially cr | |
CVE-2023-22799 |
high | 7.5 | 0.0105 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a car | |
CVE-2025-61581 |
high | 7.5 | 0.0074 | 2025-10-16 | ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Tr | |
CVE-2025-66020 |
high | 7.5 | 0.0036 | 2025-11-26 | Valibot helps validate data using a schema. In versions from 0.31.0 to 1.1.0, the EMOJI_REGEX used i | |
CVE-2026-35611 |
high | 7.5 | 0.0036 | 2026-04-07 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standa | |
CVE-2026-39320 |
high | 7.5 | 0.0043 | 2026-04-21 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25 | |
CVE-2026-45617 |
high | 7.5 | 0.0046 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version | |
CVE-2026-49293 |
high | 7.5 | 0.0064 | 2026-06-19 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to an | |
CVE-2026-52794 |
high | 7.5 | 0.0054 | 2026-06-24 | Sentry is an error tracking and performance monitoring tool. From 24.4.0 until 26.5.2, a Regular Exp | |
CVE-2026-14895 |
high | 7.5 | 0.0063 | 2026-07-07 | String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service | |
CVE-2026-59922 |
high | 7.5 | 0.0064 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tild | |
CVE-2026-59925 |
high | 7.5 | 0.0064 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of we | |
CVE-2026-59928 |
high | 7.5 | 0.0065 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document | |
CVE-2026-55470 |
high | 7.5 | 0.0068 | 2026-07-08 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J | |
CVE-2026-49477 |
high | 7.5 | 0.0064 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the | |
CVE-2026-45367 |
high | 7.5 | 0.0068 | 2026-07-16 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J | |
CVE-2026-14741 |
high | 7.5 | 0.0063 | 2026-07-17 | HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in p | |
CVE-2026-52746 |
high | 7.5 | 0.0069 | 2026-07-17 | JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matchin | |
CVE-2026-49485 |
high | 7.5 | 0.0068 | 2026-07-17 | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J | |
CVE-2026-60075 |
high | 7.5 | 0.0037 | 2026-07-30 | Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the un | |
CVE-2026-67422 |
high | 7.5 | 0.0061 | 2026-08-06 | pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to | |
CVE-2026-59893 |
high | 7.5 | 0.0034 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/key | |
CVE-2026-115887 |
high | 7.5 | 0.0041 | 2026-10-23 | GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schema | |
CVE-2026-118772 |
high | 7.5 | — | 2026-10-29 | joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 an | |
CVE-2026-118779 |
high | 7.5 | — | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2026-119202 |
high | 7.5 | — | 2026-10-29 | @hapi/content provides HTTP Content-* header parsing. From 3.0.6 until 6.0.3, Content.disposition() | |
CVE-2026-115508 |
high | 7.1 | 0.0046 | 2026-10-22 | Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in t | |
CVE-2026-118646 |
high | 7.1 | 0.0025 | 2026-10-28 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerabilit | |
CVE-2026-74039 |
high | 7.1 | 0.0056 | 2026-08-18 | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows auth | |
CVE-2024-58379 |
medium | 6.9 | 0.0042 | 2026-08-31 | nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsi |