Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-39305 |
critical | 10.0 | 0.0031 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains | |
CVE-2026-7411 |
critical | 10.0 | 0.0368 | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization | |
CVE-2026-11414 |
critical | 10.0 | 0.0048 | 2026-06-05 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the | |
CVE-2026-48055 |
critical | 10.0 | 0.0070 | 2026-06-17 | Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versi | |
CVE-2026-48282 |
critical | 10.0 | 0.4239 | 2026-06-30 | Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution | KEV |
CVE-2026-59555 |
critical | 10.0 | 0.0060 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-67429 |
critical | 10.0 | 0.0057 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.dow | |
CVE-2026-76606 |
critical | 10.0 | 0.0050 | 2026-08-22 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |
CVE-2026-70200 |
critical | 10.0 | 0.0060 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a | |
CVE-2026-113672 |
critical | 9.9 | 0.0084 | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until 3.3.15, 3 | |
CVE-2026-20180 |
critical | 9.9 | 0.0602 | 2026-04-15 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacke | |
CVE-2026-40342 |
critical | 9.9 | 0.0069 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 | |
CVE-2026-42196 |
critical | 9.9 | 0.0056 | 2026-05-12 | django-s3file is a lightweight file upload input for Django and Amazon S3. Prior to 7.0.2, S3FileMid | |
CVE-2026-42756 |
critical | 9.9 | 0.0034 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ludw | |
CVE-2026-42757 |
critical | 9.9 | 0.0036 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Sale | |
CVE-2026-57331 |
critical | 9.9 | 0.0055 | 2026-06-29 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. | |
CVE-2026-57401 |
critical | 9.9 | 0.0055 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brai | |
CVE-2026-45568 |
critical | 9.9 | 0.0054 | 2026-07-16 | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Pyth | |
CVE-2026-8859 |
critical | 9.9 | 0.0056 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to u | |
CVE-2026-71268 |
critical | 9.9 | 0.0058 | 2026-08-05 | OpenPLC Runtime v3's compile_program function (webserver/openplc.py) parses directives from uploaded | |
CVE-2026-66898 |
critical | 9.9 | 0.0059 | 2026-08-12 | A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during back | |
CVE-2026-66897 |
critical | 9.9 | 0.0072 | 2026-08-24 | A path traversal vulnerability in LXD's instance template processing allows an attacker with contain | |
CVE-2026-106486 |
critical | 9.9 | 0.0037 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin- | |
CVE-2026-113617 |
critical | 9.9 | 0.0016 | 2026-10-29 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplie | |
CVE-2023-0745 |
critical | 9.8 | 0.0051 | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can be abused | |
CVE-2026-104286 |
critical | 9.8 | 0.0457 | 2026-10-01 | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL cha | KEV |
CVE-2026-6057 |
critical | 9.8 | 0.0093 | 2026-04-10 | FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload A | |
CVE-2026-40050 |
critical | 9.8 | 0.0060 | 2026-04-21 | CrowdStrike has released security updates to address a critical unauthenticated path traversal vulne | |
CVE-2026-22070 |
critical | 9.8 | 0.0021 | 2026-04-30 | ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal. | |
CVE-2026-7524 |
critical | 9.8 | 0.0079 | 2026-05-27 | IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of | |
CVE-2026-10094 |
critical | 9.8 | 0.0038 | 2026-06-17 | A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 t | |
CVE-2026-53481 |
critical | 9.8 | 0.0063 | 2026-07-07 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-44024 |
critical | 9.8 | 0.0109 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS | |
CVE-2026-65431 |
critical | 9.8 | 0.0060 | 2026-07-23 | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives ha | |
CVE-2026-64731 |
critical | 9.8 | 0.0061 | 2026-07-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 1 | |
CVE-2026-15435 |
critical | 9.8 | 0.0073 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a | |
CVE-2026-52680 |
critical | 9.8 | 0.0111 | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when | |
CVE-2026-72567 |
critical | 9.8 | 0.0079 | 2026-08-10 | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows | |
CVE-2026-47627 |
critical | 9.8 | 0.0073 | 2026-08-18 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path | |
CVE-2026-46652 |
critical | 9.8 | 0.0070 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-107092 |
critical | 9.8 | 0.0090 | 2026-10-26 | NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. | 1 PoC |
CVE-2026-69400 |
critical | 9.6 | 0.0094 | 2026-08-20 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a | |
CVE-2026-102238 |
critical | 9.6 | 0.0082 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code | |
CVE-2026-5166 |
critical | 9.6 | 0.0033 | 2026-04-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBI | |
CVE-2026-41589 |
critical | 9.6 | 0.0039 | 2026-05-07 | Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to before ve | |
CVE-2026-57571 |
critical | 9.6 | 0.0081 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler sa | |
CVE-2026-115932 |
critical | 9.6 | 0.0043 | 2026-10-24 | When a post is published, Postiz treats a media path that is not a web address as a file on the serv | |
CVE-2026-105420 |
critical | 9.4 | 0.0052 | 2026-10-28 | Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user d | |
CVE-2026-63190 |
critical | 9.4 | 0.0054 | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior | |
CVE-2025-11366 |
critical | 9.4 | 0.0060 | 2025-11-12 | N-central < 2025.4 is vulnerable to authentication bypass via path traversal |