Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1819)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (879)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (795)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (539)
CWE-400 (526)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (439)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-11362 |
critical | 9.8 | 0.0045 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog: | |
CVE-2026-73414 |
critical | 9.2 | 0.0089 | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFuncti | |
CVE-2026-9270 |
critical | 9.1 | 0.0033 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does | |
CVE-2026-50638 |
critical | 9.1 | 0.0034 | 2026-06-10 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injec | |
CVE-2026-11373 |
critical | 9.1 | 0.0057 | 2026-06-22 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Clien | |
CVE-2026-26149 |
critical | 9.0 | 0.0056 | 2026-04-14 | Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an auth | |
CVE-2026-45038 |
high | 8.4 | 0.0018 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby | |
CVE-2026-46720 |
high | 8.2 | 0.0034 | 2026-05-17 | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and se | |
CVE-2026-50637 |
high | 8.2 | 0.0032 | 2026-06-10 | Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectio | |
CVE-2026-41526 |
high | 7.8 | 0.0017 | 2026-04-28 | In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they | |
CVE-2026-49147 |
high | 7.5 | 0.0049 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames | |
CVE-2026-8788 |
high | 7.3 | 0.0023 | 2026-05-18 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the s | |
CVE-2026-54057 |
high | 7.3 | 0.0017 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-con | |
CVE-2026-72913 |
high | 7.3 | 0.0021 | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS ha | |
CVE-2026-46719 |
medium | 6.5 | 0.0031 | 2026-05-16 | Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. The metric names were n | |
CVE-2026-50639 |
medium | 6.5 | 0.0026 | 2026-06-10 | Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric inject | |
CVE-2026-73506 |
medium | 6.1 | 0.0018 | 2026-08-13 | Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 2 | |
CVE-2026-73035 |
medium | 5.3 | 0.0037 | 2026-08-10 | npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injec | |
CVE-2026-40505 |
medium | 4.8 | 0.0017 | 2026-04-16 | MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject | |
CVE-2026-75483 |
medium | 4.8 | 0.0017 | 2026-08-17 | powerlevel10k fails to neutralize control characters in the package.json version field when renderin | |
CVE-2026-54162 |
medium | 4.7 | 0.0025 | 2026-10-28 | Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, i | |
CVE-2026-47090 |
low | 2.4 | 0.0010 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape seq | |
CVE-2026-6019 |
low | 2.1 | 0.0021 | 2026-04-22 | http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript |