Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-93434 |
high | 8.7 | 0.0046 | 2026-10-27 | An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a rem | |
CVE-2026-16731 |
high | 8.3 | 0.0044 | 2026-08-06 | OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability | |
CVE-2026-54736 |
high | 8.2 | 0.0018 | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt:: | |
CVE-2026-69247 |
high | 8.2 | 0.0027 | 2026-08-03 | cryptography is a package designed to expose cryptographic primitives and recipes to Python develope | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side auth | |
CVE-2026-16315 |
high | 8.1 | 0.0042 | 2026-08-06 | OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability | |
CVE-2026-75589 |
high | 7.5 | 0.0051 | 2026-08-19 | Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with | |
CVE-2026-5086 |
high | 7.5 | 0.0040 | 2026-04-13 | Crypt::SecretBuffer versions before 0.019 for Perl is suseceptible to timing attacks. For example, | |
CVE-2026-6656 |
high | 7.5 | 0.0049 | 2026-07-20 | Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_passwor | |
CVE-2026-13183 |
high | 7.5 | 0.0050 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing ma | |
CVE-2026-41161 |
medium | 6.9 | 0.0033 | 2026-05-08 | Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and synci | |
CVE-2026-44368 |
medium | 6.9 | 0.0031 | 2026-05-13 | PyQuorum is a cryptographic library for secret sharing and key management. Prior to 0.2.1, the mul_m | |
CVE-2026-8794 |
medium | 6.9 | 0.0068 | 2026-08-03 | PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthe | |
CVE-2026-39321 |
medium | 6.3 | 0.0023 | 2026-04-07 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node. | |
CVE-2026-48859 |
medium | 6.3 | 0.0035 | 2026-06-10 | Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows | |
CVE-2026-56764 |
medium | 6.3 | 0.0030 | 2026-07-15 | Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewar | |
CVE-2026-88010 |
medium | 6.3 | 0.0069 | 2026-09-22 | Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassw | |
CVE-2026-65630 |
medium | 5.9 | 0.0014 | 2026-10-26 | Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X2551 | |
CVE-2026-27856 |
medium | 5.9 | 0.0040 | 2026-03-27 | Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attac | |
CVE-2026-6727 |
medium | 5.9 | 0.0015 | 2026-08-11 | A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged l | |
CVE-2026-16458 |
medium | 5.9 | 0.0009 | 2026-08-13 | Padding oracle attack vulnerability in Oberon microsystem AG’s ocrypto library in all versions since | |
CVE-2026-16459 |
medium | 5.9 | 0.0009 | 2026-08-13 | Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all vers | |
CVE-2026-41418 |
medium | 5.3 | 0.0020 | 2026-04-24 | 4ga Boards is a boards system for realtime project management. Prior to 3.3.5, 4ga Boards is vulnera | |
CVE-2026-48166 |
medium | 5.3 | 0.0034 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un | |
CVE-2026-9537 |
medium | 5.3 | 0.0032 | 2026-07-17 | Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string compa | |
CVE-2026-54685 |
medium | 5.3 | 0.0034 | 2026-07-20 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the | |
CVE-2026-44255 |
medium | 5.3 | 0.0062 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-33006 |
medium | 4.8 | 0.0056 | 2026-05-04 | A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authe | |
CVE-2026-27882 |
medium | 4.8 | 0.0023 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-87946 |
medium | 4.8 | 0.0022 | 2026-10-22 | Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Forc | |
CVE-2026-41244 |
medium | 4.7 | 0.0011 | 2026-04-24 | Mojic is a CLI tool to transform readable C code into an unrecognizable chaotic stream of emojis. Pr | |
CVE-2026-33877 |
low | 3.7 | 0.0037 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-40263 |
low | 3.7 | 0.0026 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the login endpoin | |
CVE-2026-22746 |
low | 3.7 | 0.0022 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAc | |
CVE-2026-43514 |
low | 3.7 | 0.0035 | 2026-05-12 | Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue | |
CVE-2026-13758 |
low | 3.7 | 0.0040 | 2026-06-29 | CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in t | |
CVE-2026-70437 |
low | 3.7 | 0.0027 | 2026-08-05 | Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a cons | |
CVE-2026-41514 |
low | 3.3 | 0.0013 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r | |
CVE-2026-41515 |
low | 3.3 | 0.0013 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r | |
CVE-2026-41516 |
low | 3.3 | 0.0014 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r | |
CVE-2026-21840 |
low | 3.1 | 0.0024 | 2026-07-14 | HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, t |