Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2641)
CWE-79 (1901)
CWE-416 (1381)
CWE-862 (1231)
CWE-89 (1114)
CWE-22 (1038)
CWE-125 (936)
CWE-306 (859)
CWE-200 (857)
CWE-122 (832)
CWE-20 (803)
CWE-787 (732)
CWE-78 (723)
CWE-918 (701)
CWE-863 (660)
CWE-94 (649)
CWE-74 (604)
CWE-639 (571)
CWE-400 (539)
CWE-269 (507)
CWE-119 (504)
CWE-502 (478)
CWE-770 (450)
CWE-287 (444)
CWE-121 (411)
CWE-190 (380)
CWE-362 (375)
CWE-77 (375)
CWE-476 (305)
CWE-352 (288)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-44181 |
critical | 10.0 | 0.0077 | 2026-07-16 | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like | |
CVE-2026-48323 |
critical | 10.0 | 0.0137 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a | |
CVE-2026-73299 |
critical | 10.0 | 0.0178 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the T | |
CVE-2026-47752 |
critical | 9.9 | 0.0044 | 2026-07-23 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 | |
CVE-2026-72911 |
critical | 9.9 | 0.0072 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, | |
CVE-2026-65974 |
critical | 9.9 | 0.0103 | 2026-08-17 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, | |
CVE-2025-60355 |
critical | 9.8 | 0.0053 | 2025-10-28 | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via Free | |
CVE-2026-15734 |
critical | 9.8 | 0.0077 | 2026-08-06 | A Server-Side Template Injection (SSTI) vulnerability in WGDashboard version 4.3.2 and earlier, allo | |
CVE-2026-35044 |
critical | 9.6 | 0.0039 | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and model infe | |
CVE-2026-9177 |
critical | 9.4 | 0.0050 | 2026-07-29 | A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functiona | |
CVE-2026-54390 |
critical | 9.3 | 0.0060 | 2026-06-18 | JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that a | 1 PoC |
CVE-2026-55486 |
critical | 9.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-55240 |
critical | 9.1 | 0.0075 | 2026-10-15 | Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, | |
CVE-2026-96355 |
critical | 9.1 | 0.0042 | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Webfor | |
CVE-2026-61707 |
critical | 9.0 | 0.0024 | 2026-10-29 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations nee | |
CVE-2026-33654 |
high | 8.9 | 0.0051 | 2026-03-27 | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerabili | |
CVE-2023-2017 |
high | 8.8 | 0.0207 | 2023-04-17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), af | |
CVE-2026-55242 |
high | 8.8 | 0.0020 | 2026-07-15 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, | |
CVE-2026-54653 |
high | 8.8 | 0.0071 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-71291 |
high | 8.8 | 0.0055 | 2026-08-05 | Bolt CMS renders content field values through Twig's full application-level Environment with no Sand | |
CVE-2026-115189 |
high | 8.8 | 0.0059 | 2026-10-26 | A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. | |
CVE-2026-55794 |
high | 8.7 | 0.0041 | 2026-07-02 | Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control | |
CVE-2026-69118 |
high | 8.7 | 0.0080 | 2026-08-10 | Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template re | |
CVE-2026-115938 |
high | 8.7 | 0.0037 | 2026-10-23 | Craft CMS allows any authenticated control panel user to submit an element-search condition whose el | |
CVE-2026-119144 |
high | 8.7 | 0.0031 | 2026-10-29 | Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection v | |
CVE-2024-58293 |
high | 8.6 | 0.0035 | 2025-12-11 | Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated ad | |
CVE-2026-42203 |
high | 8.6 | 0.0037 | 2026-05-08 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1 | |
CVE-2026-11407 |
high | 8.6 | 0.0062 | 2026-06-17 | Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated adm | |
CVE-2026-75829 |
high | 8.6 | 0.0041 | 2026-08-18 | grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, al | |
CVE-2026-94109 |
high | 8.6 | 0.0078 | 2026-09-20 | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerab | |
CVE-2026-92982 |
high | 8.5 | 0.0047 | 2026-10-15 | A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 | |
CVE-2026-44129 |
high | 8.3 | 0.0053 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulner | |
CVE-2026-54661 |
high | 8.3 | 0.0048 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior | |
CVE-2026-54662 |
high | 8.3 | 0.0035 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-54664 |
high | 8.3 | 0.0048 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior | |
CVE-2026-54666 |
high | 8.3 | 0.0036 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior | |
CVE-2026-41713 |
high | 8.2 | 0.0022 | 2026-05-12 | A malicious user could craft input that is stored in conversation memory and later interpreted by th | |
CVE-2026-71239 |
high | 8.1 | 0.0039 | 2026-08-05 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Dja | |
CVE-2026-54621 |
high | 7.8 | 0.0021 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, Grap | |
CVE-2026-54654 |
high | 7.8 | 0.0021 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.6 | |
CVE-2026-73505 |
high | 7.8 | 0.0021 | 2026-08-13 | Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 2 | |
CVE-2026-34587 |
high | 7.6 | 0.0033 | 2026-04-24 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user p | |
CVE-2026-71880 |
high | 7.6 | 0.0048 | 2026-08-18 | Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions | |
CVE-2026-118803 |
high | 7.5 | 0.0037 | 2026-10-28 | Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability t | |
CVE-2026-47690 |
high | 7.5 | 0.0052 | 2026-07-21 | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions o | |
CVE-2026-73330 |
high | 7.5 | 0.0079 | 2026-08-12 | CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated | |
CVE-2026-26026 |
high | 7.2 | 0.1153 | 2026-04-06 | GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template inje | |
CVE-2026-33392 |
high | 7.2 | 0.0043 | 2026-04-17 | In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass | |
CVE-2026-71286 |
medium | 6.1 | 0.0026 | 2026-08-05 | The render-template component of ember-dynamic-render-template (addon/components/render-template.js) | |
CVE-2026-40602 |
medium | 5.6 | 0.0010 | 2026-04-21 | The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up t |