Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-49401 |
high | 8.4 | 0.0020 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.14, Deno's permission system | |
CVE-2026-45062 |
high | 8.1 | 0.0071 | 2026-06-10 | FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the | |
CVE-2026-45135 |
high | 8.1 | 0.0068 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCG | |
CVE-2026-7040 |
high | 7.5 | 0.0044 | 2026-04-27 | Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some | |
CVE-2026-110687 |
high | 7.5 | 0.0017 | 2026-10-19 | Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical | |
CVE-2026-4116 |
high | 7.2 | 0.0042 | 2026-04-09 | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authent | |
CVE-2026-62374 |
high | 7.1 | — | 2026-10-29 | SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In | |
CVE-2026-116542 |
medium | 6.9 | 0.0021 | 2026-10-26 | Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows | |
CVE-2026-4114 |
medium | 6.6 | 0.0060 | 2026-04-09 | Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authent | |
CVE-2026-20202 |
medium | 6.6 | 0.0025 | 2026-04-15 | In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform ve | |
CVE-2026-48618 |
medium | 6.5 | 0.0314 | 2026-06-26 | A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to | |
CVE-2026-110674 |
medium | 6.5 | 0.0020 | 2026-10-19 | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowin | |
CVE-2026-59890 |
medium | 6.1 | 0.0040 | 2026-07-08 | setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python | |
CVE-2026-114114 |
medium | 6.0 | 0.0026 | 2026-10-21 | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets | |
CVE-2026-35373 |
medium | 5.5 | 0.0012 | 2026-04-22 | A logic error in the ln utility of uutils coreutils causes the program to reject source paths contai | |
CVE-2026-35346 |
low | 3.3 | 0.0018 | 2026-04-22 | The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on | |
CVE-2026-35375 |
low | 3.3 | 0.0014 | 2026-04-22 | A logic error in the split utility of uutils coreutils causes the corruption of output filenames whe |