Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2614)
CWE-79 (1799)
CWE-416 (1282)
CWE-862 (1168)
CWE-89 (1090)
CWE-22 (1018)
CWE-125 (867)
CWE-200 (840)
CWE-306 (832)
CWE-122 (826)
CWE-20 (789)
CWE-78 (701)
CWE-918 (685)
CWE-787 (677)
CWE-94 (637)
CWE-863 (603)
CWE-74 (600)
CWE-639 (534)
CWE-400 (513)
CWE-269 (499)
CWE-119 (494)
CWE-502 (467)
CWE-770 (432)
CWE-287 (424)
CWE-121 (404)
CWE-77 (372)
CWE-190 (362)
CWE-362 (321)
CWE-352 (271)
CWE-285 (241)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-3490 |
critical | 10.0 | 0.0082 | 2026-06-17 | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire | |
CVE-2026-115915 |
critical | 9.8 | 0.0066 | 2026-10-26 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO pas | |
CVE-2026-50189 |
high | 8.9 | 0.0049 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, Appsmith | |
CVE-2026-46391 |
high | 8.7 | 0.0046 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and p | |
CVE-2026-67345 |
high | 8.5 | 0.0056 | 2026-07-30 | MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vul | |
CVE-2026-21915 |
high | 8.4 | 0.0224 | 2026-04-09 | A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JS | |
CVE-2026-46608 |
high | 7.4 | 0.0040 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC | |
CVE-2026-8918 |
high | 7.1 | 0.0028 | 2026-06-22 | A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform ar | |
CVE-2026-116339 |
medium | 6.9 | 0.0048 | 2026-10-26 | A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function | |
CVE-2026-96229 |
medium | 6.5 | 0.0095 | 2026-10-13 | Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information ov | |
CVE-2026-59802 |
medium | 6.3 | 0.0024 | 2026-07-08 | PasswordPusher before 2.8.1 accepts data URI schemes in URL push payloads due to insufficient valida | |
CVE-2026-46341 |
medium | 6.1 | 0.0023 | 2026-07-16 | The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, craw | |
CVE-2026-41240 |
medium | 6.0 | 0.0031 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to | |
CVE-2026-54316 |
medium | 6.0 | 0.0052 | 2026-06-23 | Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface. | |
CVE-2026-66005 |
medium | 5.3 | 0.0033 | 2026-07-24 | Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its lo | |
CVE-2026-117570 |
medium | 4.8 | 0.0024 | 2026-10-27 | Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in | |
CVE-2026-113786 |
low | 2.3 | 0.0037 | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.1, an attacker can craft a PD | |
CVE-2026-15625 |
low | 2.1 | 0.0048 | 2026-07-14 | A vulnerability was found in nextlevelbuilder GoClaw 3.11.3. Affected by this issue is the function | |
CVE-2026-16129 |
low | 1.9 | 0.0032 | 2026-07-18 | A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the |