Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-112901 |
medium | 6.9 | 0.0053 | 2026-10-19 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's XBM header parser is vulnerable to reg | |
CVE-2023-25166 |
medium | 6.5 | 0.0061 | 2023-02-08 | formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided string | |
CVE-2026-35041 |
medium | 6.5 | 0.0026 | 2026-04-09 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 5.0.0 to 6.2.0, a denial-of-service | |
CVE-2026-15154 |
medium | 6.5 | 0.0048 | 2026-07-08 | A flaw was found in `guardrails-detectors`, a component of Red Hat OpenShift AI. This vulnerability, | |
CVE-2026-62237 |
medium | 6.0 | 0.0030 | 2026-07-17 | Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex | |
CVE-2026-5986 |
medium | 5.5 | 0.0037 | 2026-04-09 | A weakness has been identified in Zod jsVideoUrlParser up to 0.5.1. The impacted element is the func | |
CVE-2026-114603 |
medium | 5.3 | 0.0049 | 2026-10-22 | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentel | |
CVE-2026-118259 |
medium | 5.3 | 0.0049 | 2026-10-28 | opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and | |
CVE-2026-0668 |
medium | 5.3 | 0.0048 | 2026-01-07 | Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualDa | |
CVE-2026-48125 |
medium | 5.3 | 0.0052 | 2026-07-14 | UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from us | |
CVE-2026-23985 |
medium | 5.3 | 0.0065 | 2026-07-30 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5. | |
CVE-2026-66062 |
medium | 5.3 | 0.0051 | 2026-08-07 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Pr | |
CVE-2026-69207 |
medium | 5.3 | 0.0061 | 2026-08-07 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-109295 |
medium | 5.3 | 0.0033 | 2026-10-12 | Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability t | |
CVE-2026-72912 |
medium | 4.3 | 0.0032 | 2026-08-10 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.3.0, Cy | |
CVE-2026-40319 |
low | 1.0 | 0.0015 | 2026-04-17 | Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMa | |
CVE-2026-116268 |
— | — | 0.0018 | 2026-10-28 | MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via unclosed comments in h | |
CVE-2026-116285 |
— | — | 0.0029 | 2026-10-28 | HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking wh | |
CVE-2026-117500 |
— | — | 0.0026 | 2026-10-28 | HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filen | |
CVE-2026-115822 |
— | — | 0.0027 | 2026-10-25 | Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when p |