Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1854)
CWE-416 (1298)
CWE-862 (1188)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (849)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-50144 |
high | 7.1 | 0.0016 | 2026-07-15 | ncnn is a high-performance neural network inference framework optimized for the mobile platform. In | |
CVE-2026-17741 |
high | 7.1 | 0.0022 | 2026-07-30 | Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.792 | |
CVE-2026-17867 |
high | 7.1 | 0.0022 | 2026-07-30 | Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a | |
CVE-2026-17888 |
high | 7.1 | 0.0021 | 2026-07-30 | Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed | |
CVE-2026-15316 |
high | 7.1 | 0.0033 | 2026-08-18 | An improper input validation vulnerability in the configuration service for processing encrypted cre | |
CVE-2026-85170 |
high | 7.1 | 0.0040 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo no | |
CVE-2026-57210 |
high | 7.0 | 0.0031 | 2026-10-23 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-13006 |
high | 7.0 | 0.0018 | 2026-06-24 | ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and inc | |
CVE-2026-53411 |
high | 7.0 | 0.0014 | 2026-07-16 | A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation proces | |
CVE-2026-91415 |
high | 7.0 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-57209 |
high | 7.0 | 0.0034 | 2026-10-23 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-114099 |
medium | 6.9 | 0.0029 | 2026-10-21 | Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-se | |
CVE-2026-41890 |
medium | 6.9 | 0.0041 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-55602 |
medium | 6.9 | 0.0038 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, | |
CVE-2026-61427 |
medium | 6.9 | 0.0043 | 2026-07-15 | PraisonAI before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the | |
CVE-2026-49208 |
medium | 6.9 | 0.0041 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, when a #[LivePr | |
CVE-2026-63734 |
medium | 6.9 | 0.0047 | 2026-07-20 | SurrealDB versions before 3.2.0 contain a denial of service vulnerability in the SurrealML header pa | |
CVE-2026-16551 |
medium | 6.9 | 0.0043 | 2026-07-22 | Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocatio | |
CVE-2026-54272 |
medium | 6.9 | 0.0040 | 2026-07-27 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions | |
CVE-2026-59881 |
medium | 6.9 | 0.0052 | 2026-07-30 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the | |
CVE-2026-69198 |
medium | 6.9 | 0.0048 | 2026-08-03 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10. | |
CVE-2026-21058 |
medium | 6.9 | 0.0014 | 2026-08-10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers | |
CVE-2026-75987 |
medium | 6.9 | 0.0056 | 2026-08-19 | A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStr | |
CVE-2026-110870 |
medium | 6.9 | 0.0027 | 2026-10-14 | Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its addr | |
CVE-2026-114100 |
medium | 6.9 | 0.0028 | 2026-10-21 | Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body proces | |
CVE-2024-6541 |
medium | 6.8 | 0.0034 | 2026-08-06 | The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are | |
CVE-2026-65834 |
medium | 6.8 | 0.0032 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfig | |
CVE-2026-9031 |
medium | 6.8 | 0.0026 | 2026-08-07 | An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation | |
CVE-2026-21083 |
medium | 6.8 | 0.0026 | 2026-08-10 | Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to acc | |
CVE-2026-72711 |
medium | 6.8 | 0.0018 | 2026-08-24 | The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_ | |
CVE-2026-88089 |
medium | 6.7 | 0.0031 | 2026-10-13 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | |
CVE-2026-60526 |
medium | 6.7 | 0.0015 | 2026-07-21 | Vulnerability in Oracle Java SE (component: Installation). Supported versions that are affected are | |
CVE-2026-21060 |
medium | 6.7 | 0.0021 | 2026-08-10 | Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attack | |
CVE-2026-60613 |
medium | 6.6 | 0.0040 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (componen | |
CVE-2026-113913 |
medium | 6.5 | 0.0061 | 2026-10-26 | An input validation issue was addressed with improved input validation. This issue is fixed in iOS 2 | |
CVE-2026-88858 |
medium | 6.5 | 0.0034 | 2026-10-28 | A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math | |
CVE-2026-70105 |
medium | 6.5 | 0.0097 | 2026-08-20 | Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose infor | |
CVE-2026-102867 |
medium | 6.5 | 0.0099 | 2026-10-13 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information | |
CVE-2026-105719 |
medium | 6.5 | 0.0109 | 2026-10-13 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to disclose i | |
CVE-2026-85797 |
medium | 6.5 | 0.0091 | 2026-10-13 | Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information over a net | |
CVE-2022-47924 |
medium | 6.5 | 0.0026 | 2023-03-27 | An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-li | |
CVE-2026-33882 |
medium | 6.5 | 0.0027 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and | |
CVE-2026-20097 |
medium | 6.5 | 0.0041 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-5329 |
medium | 6.5 | 0.0046 | 2026-04-09 | Rapid7 Velociraptor versions prior to 0.76.2 contain an improper input validation vulnerability in t | |
CVE-2026-32201 |
medium | 6.5 | 0.4338 | 2026-04-14 | Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unaut | KEV |
CVE-2026-22748 |
medium | 6.5 | 0.0020 | 2026-04-22 | Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtD | |
CVE-2026-24204 |
medium | 6.5 | 0.0036 | 2026-04-28 | NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation b | |
CVE-2026-1577 |
medium | 6.5 | 0.0034 | 2026-04-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 C | |
CVE-2026-20685 |
medium | 6.5 | 0.0027 | 2026-05-18 | An attacker in a privileged network position may be able to leak sensitive information. A path handl | |
CVE-2026-10651 |
medium | 6.5 | 0.0030 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record b |