Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-49869 |
critical | 10.0 | 0.0209 | 2026-06-26 | Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote | KEV |
CVE-2026-13448 |
critical | 9.8 | 0.0067 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution | |
CVE-2026-70470 |
critical | 9.5 | 0.0097 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-55743 |
critical | 9.4 | 0.0039 | 2026-06-17 | The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (de | |
CVE-2026-34415 |
critical | 9.3 | 0.0357 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability | |
CVE-2026-74886 |
critical | 9.3 | 0.0068 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the Plugin | |
CVE-2026-41264 |
critical | 9.2 | 0.0179 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-114615 |
critical | 9.1 | 0.0019 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, O | |
CVE-2026-34177 |
critical | 9.1 | 0.0036 | 2026-04-09 | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidde | |
CVE-2026-108471 |
high | 8.8 | 0.0037 | 2026-10-13 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an autho | |
CVE-2023-2017 |
high | 8.8 | 0.0207 | 2023-04-17 | Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), af | |
CVE-2026-14534 |
high | 8.8 | 0.0059 | 2026-07-04 | Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard librar | |
CVE-2026-17630 |
high | 8.8 | 0.0076 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to | |
CVE-2026-96196 |
high | 8.8 | — | 2026-10-29 | Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attac | |
CVE-2026-41934 |
high | 8.7 | 0.0054 | 2026-05-06 | Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the ad | |
CVE-2026-62199 |
high | 8.7 | 0.0053 | 2026-07-13 | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss in | |
CVE-2026-62200 |
high | 8.7 | 0.0053 | 2026-07-13 | OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow | |
CVE-2026-69263 |
high | 8.7 | 0.0066 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-72779 |
high | 8.7 | 0.0038 | 2026-08-11 | Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnera | |
CVE-2026-67615 |
high | 8.7 | 0.0054 | 2026-09-22 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allow | |
CVE-2026-34430 |
high | 8.6 | 0.0041 | 2026-04-01 | ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash t | |
CVE-2026-73484 |
high | 8.6 | 0.0043 | 2026-08-13 | Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to | |
CVE-2026-43991 |
high | 8.4 | 0.0017 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based | |
CVE-2026-59261 |
high | 8.4 | 0.0027 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files | |
CVE-2026-55830 |
high | 8.3 | 0.0029 | 2026-07-08 | RestrictedPython is a tool that helps to define a subset of the Python language which allows to prov | |
CVE-2026-43929 |
high | 8.2 | 0.0027 | 2026-05-12 | ssrfcheck is a library that checks if a string contains a potential SSRF attack. In 1.3.0 and earlie | |
CVE-2026-49825 |
high | 8.2 | 0.0030 | 2026-08-20 | lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attribute | |
CVE-2026-31952 |
high | 8.1 | 0.0025 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-54512 |
high | 8.1 | 0.0094 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-62203 |
high | 7.7 | 0.0053 | 2026-07-17 | OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host ex | |
CVE-2026-63108 |
high | 7.7 | 0.0177 | 2026-07-20 | Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute featu | |
CVE-2026-110205 |
high | 7.7 | 0.0051 | 2026-10-13 | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that | |
CVE-2026-53855 |
high | 7.6 | 0.0026 | 2026-06-16 | OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operato | |
CVE-2026-45741 |
high | 7.5 | 0.0037 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, the IsPublicIP fun | |
CVE-2026-35000 |
high | 7.1 | 0.0029 | 2026-04-01 | ChangeDetection.io versions prior to 0.54.7 contain a protection bypass vulnerability in the SafeXPa | |
CVE-2026-45037 |
high | 7.1 | 0.0014 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's term | |
CVE-2026-54070 |
high | 7.1 | 0.0030 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME i | |
CVE-2026-41206 |
medium | 6.9 | 0.0019 | 2026-04-23 | PySpector is a static analysis security testing (SAST) Framework engineered for modern Python develo | |
CVE-2026-116339 |
medium | 6.9 | 0.0048 | 2026-10-26 | A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function | |
CVE-2026-117530 |
medium | 6.7 | 0.0011 | 2026-10-27 | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of | |
CVE-2026-26274 |
medium | 6.6 | 0.0023 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnera | |
CVE-2026-115751 |
medium | 6.3 | 0.0025 | 2026-10-23 | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerabi | |
CVE-2026-39315 |
medium | 6.1 | 0.0029 | 2026-04-09 | Unhead is a document head and template manager. Prior to 2.1.13, useHeadSafe() is the composable tha | |
CVE-2026-44587 |
medium | 6.1 | 0.0022 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3. | |
CVE-2026-59929 |
medium | 6.1 | 0.0034 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter | |
CVE-2026-53944 |
medium | 5.8 | 0.0033 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external reque | |
CVE-2026-56777 |
medium | 5.3 | 0.0033 | 2026-06-30 | n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST) security validator | |
CVE-2026-50251 |
medium | 5.3 | 0.0025 | 2026-07-22 | In NLnet Labs Unbound up to and including version 1.25.1, when 'unwanted-reply-threshold' is enabled | |
CVE-2026-70466 |
medium | 5.3 | 0.0031 | 2026-08-12 | A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, Forti | |
CVE-2026-114728 |
medium | 5.3 | 0.0038 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypa |