Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1099)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-62519 |
medium | 6.3 | 0.0026 | 2026-07-21 | Vulnerability in the Oracle Succession planning product of Oracle E-Business Suite (component: Succe | |
CVE-2026-54205 |
medium | 6.3 | 0.0049 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) | |
CVE-2026-54206 |
medium | 6.3 | 0.0049 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @ | |
CVE-2026-54207 |
medium | 6.3 | 0.0049 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an | |
CVE-2026-63335 |
medium | 6.3 | 0.0052 | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w | |
CVE-2026-89317 |
medium | 6.3 | 0.0015 | 2026-10-23 | gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read it. RFC 7515 §4.1.11 req | |
CVE-2026-116164 |
medium | 6.3 | 0.0034 | 2026-10-25 | Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field | |
CVE-2026-34666 |
medium | 6.2 | 0.0026 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Imprope | |
CVE-2026-34668 |
medium | 6.2 | 0.0019 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Imprope | |
CVE-2026-34669 |
medium | 6.2 | 0.0019 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Imprope | |
CVE-2026-34670 |
medium | 6.2 | 0.0026 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Imprope | |
CVE-2026-34679 |
medium | 6.2 | 0.0019 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Imprope | |
CVE-2026-34688 |
medium | 6.2 | 0.0026 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Imprope | |
CVE-2026-47470 |
medium | 6.2 | 0.0016 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, | |
CVE-2026-14961 |
medium | 6.2 | 0.0016 | 2026-07-15 | Pegatron `Tdelo64.sys` exposes a privileged device interface, `\\.\TdeIo`, that fails to properly re | |
CVE-2026-118173 |
medium | 6.1 | 0.0030 | 2026-10-27 | MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete valid | |
CVE-2026-33436 |
medium | 6.1 | 0.0017 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. I | |
CVE-2026-7953 |
medium | 6.1 | 0.0017 | 2026-05-06 | Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 148.0.7778.96 allowe | |
CVE-2026-14083 |
medium | 6.1 | 0.0022 | 2026-06-30 | Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a | |
CVE-2026-46341 |
medium | 6.1 | 0.0023 | 2026-07-16 | The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, craw | |
CVE-2026-54728 |
medium | 6.1 | 0.0038 | 2026-07-16 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1 | |
CVE-2026-54663 |
medium | 6.1 | 0.0022 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-15792 |
medium | 6.0 | 0.0024 | 2026-07-21 | A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon cra | |
CVE-2026-13057 |
medium | 6.0 | 0.0035 | 2026-07-22 | An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user ac | |
CVE-2026-21061 |
medium | 6.0 | 0.0041 | 2026-08-10 | Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers | |
CVE-2026-115883 |
medium | 6.0 | 0.0030 | 2026-10-23 | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph work | |
CVE-2026-42387 |
medium | 5.9 | 0.0048 | 2026-06-25 | A malicious authoritative server can send a crafted zone via the ZoneToCache function that leads to | |
CVE-2026-42388 |
medium | 5.9 | 0.0048 | 2026-06-25 | Incomplete validation of the SOA record present in a catalog zone might lead to a crash. | |
CVE-2026-11914 |
medium | 5.9 | 0.0035 | 2026-07-10 | vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*. | |
CVE-2026-48308 |
medium | 5.9 | 0.0024 | 2026-07-14 | Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Securi | |
CVE-2026-119210 |
medium | 5.9 | — | 2026-10-29 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases | |
CVE-2024-10302 |
medium | 5.8 | 0.0029 | 2026-08-06 | The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input | |
CVE-2026-53723 |
medium | 5.8 | 0.0022 | 2026-06-11 | Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service de | |
CVE-2026-39998 |
medium | 5.8 | 0.0068 | 2026-06-19 | Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certai | |
CVE-2026-61079 |
medium | 5.8 | 0.0011 | 2026-07-21 | Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are | |
CVE-2026-17736 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.792 | |
CVE-2026-17806 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 all | |
CVE-2026-17809 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 all | |
CVE-2026-17890 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allow | |
CVE-2026-17893 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 151.0.7922.72 | |
CVE-2026-17906 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allo | |
CVE-2026-17908 |
medium | 5.8 | 0.0020 | 2026-07-30 | Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 151.0.79 | |
CVE-2026-34855 |
medium | 5.7 | 0.0011 | 2026-04-13 | Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this vuln | |
CVE-2026-11835 |
medium | 5.7 | 0.0011 | 2026-08-04 | Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra | |
CVE-2026-28322 |
medium | 5.6 | 0.0039 | 2026-06-30 | SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting v | |
CVE-2026-83798 |
medium | 5.5 | 0.0024 | 2026-10-13 | Improper verification of cryptographic signature in Windows Update Stack allows an authorized attack | |
CVE-2026-55124 |
medium | 5.5 | 0.0060 | 2026-07-14 | Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attac | |
CVE-2026-70312 |
medium | 5.5 | 0.0043 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose | |
CVE-2026-70314 |
medium | 5.5 | 0.0054 | 2026-08-11 | Improper input validation in Microsoft Office allows an unauthorized attacker to disclose informatio | |
CVE-2026-70316 |
medium | 5.5 | 0.0043 | 2026-08-11 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose |