Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-56306 |
medium | 5.3 | 0.0030 | 2026-06-22 | Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allo | |
CVE-2026-42389 |
medium | 5.3 | 0.0030 | 2026-06-25 | This fix provides extra hardening for the 5.4.x branch by doing extra validation of incoming answers | |
CVE-2026-42390 |
medium | 5.3 | 0.0030 | 2026-06-25 | An invalid zone might pass ZONEMD validation while it should not. This is only relevant if ZoneToCac | |
CVE-2026-13875 |
medium | 5.3 | 0.0028 | 2026-06-30 | Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 | |
CVE-2026-13877 |
medium | 5.3 | 0.0037 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed | |
CVE-2026-13911 |
medium | 5.3 | 0.0030 | 2026-06-30 | Insufficient policy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 allowed a remo | |
CVE-2026-13961 |
medium | 5.3 | 0.0028 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.78 | |
CVE-2026-14117 |
medium | 5.3 | 0.0028 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.78 | |
CVE-2026-56333 |
medium | 5.3 | 0.0028 | 2026-06-30 | Capgo before 12.128.2 contains a server-side validation bypass vulnerability in organization securit | |
CVE-2026-14414 |
medium | 5.3 | 0.0025 | 2026-07-01 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a | |
CVE-2026-46453 |
medium | 5.3 | 0.0055 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache | |
CVE-2026-48206 |
medium | 5.3 | 0.0055 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache | |
CVE-2026-15529 |
medium | 5.3 | 0.0044 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persi | |
CVE-2026-6790 |
medium | 5.3 | 0.0031 | 2026-07-14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request | |
CVE-2026-15771 |
medium | 5.3 | 0.0030 | 2026-07-14 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871. | |
CVE-2026-44978 |
medium | 5.3 | 0.0053 | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a heap out-of-bounds read vulne | |
CVE-2026-46452 |
medium | 5.3 | 0.0091 | 2026-07-24 | Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result i | |
CVE-2026-17909 |
medium | 5.3 | 0.0027 | 2026-07-30 | Insufficient validation of untrusted input in Isolated Web Apps in Google Chrome prior to 151.0.7922 | |
CVE-2026-54909 |
medium | 5.3 | 0.0064 | 2026-07-31 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while | |
CVE-2026-54199 |
medium | 5.3 | 0.0044 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the reques | |
CVE-2026-54217 |
medium | 5.3 | 0.0044 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An | |
CVE-2026-49392 |
medium | 5.3 | 0.0030 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-115479 |
medium | 5.3 | 0.0030 | 2026-10-23 | baserCMS is a website development framework. In versions 5.2.5 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-55442 |
medium | 5.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-55444 |
medium | 5.3 | 0.0025 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-111974 |
medium | 5.3 | 0.0019 | 2026-10-26 | The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one | |
CVE-2026-45076 |
medium | 5.1 | 0.0037 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, ma | |
CVE-2026-21066 |
medium | 5.1 | 0.0015 | 2026-08-10 | Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local a | |
CVE-2026-21070 |
medium | 5.1 | 0.0021 | 2026-08-10 | Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attacke | |
CVE-2026-21071 |
medium | 5.1 | 0.0015 | 2026-08-10 | Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows loca | |
CVE-2026-21072 |
medium | 5.1 | 0.0015 | 2026-08-10 | Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local | |
CVE-2026-73158 |
medium | 5.1 | 0.0040 | 2026-08-11 | Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph con | |
CVE-2026-55644 |
medium | 5.1 | 0.0038 | 2026-10-19 | Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails | |
CVE-2026-13434 |
medium | 4.9 | 0.0024 | 2026-06-26 | A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineI | |
CVE-2026-1858 |
medium | 4.8 | 0.0015 | 2026-04-29 | wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the | |
CVE-2026-14723 |
medium | 4.8 | 0.0032 | 2026-07-05 | A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of | |
CVE-2026-70589 |
medium | 4.8 | 0.0027 | 2026-08-04 | Ghost is a Node.js content management system. From 4.22.0 until 6.54.1, a missing validation check a | |
CVE-2026-21065 |
medium | 4.8 | 0.0015 | 2026-08-10 | Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attacker | |
CVE-2024-9407 |
medium | 4.7 | 0.0029 | 2024-10-01 | A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The | |
CVE-2026-13812 |
medium | 4.7 | 0.0019 | 2026-06-30 | Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0. | |
CVE-2026-62917 |
medium | 4.6 | 0.0058 | 2026-08-11 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform sp | |
CVE-2026-13808 |
medium | 4.6 | 0.0014 | 2026-06-30 | Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowe | |
CVE-2026-86020 |
medium | 4.6 | 0.0015 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-27906 |
medium | 4.4 | 0.0039 | 2026-04-14 | Improper input validation in Windows Hello allows an authorized attacker to bypass a security featur | |
CVE-2026-35347 |
medium | 4.4 | 0.0014 | 2026-04-22 | The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before p | |
CVE-2026-7941 |
medium | 4.4 | 0.0011 | 2026-05-06 | Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 148.0.7778 | |
CVE-2026-43895 |
medium | 4.4 | 0.0016 | 2026-05-11 | jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import p | |
CVE-2026-7915 |
medium | 4.3 | 0.0024 | 2026-05-06 | Insufficient data validation in DevTools in Google Chrome on Android prior to 148.0.7778.96 allowed | |
CVE-2026-7961 |
medium | 4.3 | 0.0017 | 2026-05-06 | Insufficient validation of untrusted input in Permissions in Google Chrome prior to 148.0.7778.96 al | |
CVE-2026-8005 |
medium | 4.3 | 0.0010 | 2026-05-06 | Insufficient validation of untrusted input in Cast in Google Chrome prior to 148.0.7778.96 allowed a |