Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2636)
CWE-79 (1863)
CWE-416 (1372)
CWE-862 (1194)
CWE-89 (1108)
CWE-22 (1030)
CWE-125 (919)
CWE-200 (851)
CWE-306 (841)
CWE-122 (832)
CWE-20 (801)
CWE-78 (718)
CWE-787 (714)
CWE-918 (695)
CWE-863 (649)
CWE-94 (642)
CWE-74 (602)
CWE-639 (551)
CWE-400 (535)
CWE-119 (504)
CWE-269 (502)
CWE-502 (472)
CWE-770 (447)
CWE-287 (434)
CWE-121 (410)
CWE-190 (377)
CWE-77 (375)
CWE-362 (373)
CWE-476 (299)
CWE-352 (284)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-57696 |
high | 7.1 | 0.0041 | 2026-07-23 | Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. | |
CVE-2026-65607 |
high | 7.1 | 0.0059 | 2026-07-23 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit bran | |
CVE-2026-54545 |
high | 7.1 | 0.0020 | 2026-07-28 | wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli saniti | |
CVE-2026-67247 |
high | 7.1 | 0.0045 | 2026-07-30 | A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs be | |
CVE-2026-9856 |
high | 7.1 | 0.0046 | 2026-08-02 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbi | |
CVE-2026-47487 |
high | 7.1 | 0.0023 | 2026-08-04 | NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files out | |
CVE-2026-47682 |
high | 7.1 | 0.0045 | 2026-08-04 | CVAT is an open source interactive video and image annotation tool for computer vision. In versions | |
CVE-2026-72770 |
high | 7.1 | 0.0070 | 2026-08-11 | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, a | |
CVE-2026-18640 |
high | 7.1 | 0.0043 | 2026-08-11 | The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user wit | |
CVE-2026-73291 |
high | 7.1 | 0.0039 | 2026-08-12 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to v | |
CVE-2026-17094 |
high | 7.1 | 0.0054 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa | |
CVE-2026-19589 |
high | 7.1 | 0.0019 | 2026-08-17 | Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow uni | |
CVE-2026-48798 |
high | 7.1 | 0.0042 | 2026-08-18 | SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string | |
CVE-2026-84823 |
high | 7.1 | 0.0042 | 2026-10-15 | A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based | |
CVE-2022-51025 |
high | 7.1 | 0.0046 | 2026-10-22 | Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows au | |
CVE-2023-53907 |
high | 7.1 | 0.0081 | 2025-12-17 | Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plu | |
CVE-2026-97164 |
high | 7.0 | 0.0032 | 2026-09-27 | Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Ev | |
CVE-2026-116195 |
high | 7.0 | 0.0023 | 2026-10-25 | Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink fu | |
CVE-2026-55092 |
high | 7.0 | 0.0044 | 2026-06-25 | Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org. | |
CVE-2026-58460 |
high | 7.0 | 0.0019 | 2026-07-02 | react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-residen | |
CVE-2026-54684 |
high | 7.0 | 0.0020 | 2026-07-14 | jadx is a Dex to Java decompiler. From 1.5.2 to 1.5.5, a malicious .xapk file can cause jadx to writ | |
CVE-2026-59863 |
high | 7.0 | 0.0137 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota honored a po | |
CVE-2026-13103 |
high | 7.0 | 0.0018 | 2026-07-16 | A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively i | |
CVE-2026-67245 |
high | 7.0 | 0.0033 | 2026-07-30 | A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occurs bec | |
CVE-2026-74038 |
high | 7.0 | 0.0055 | 2026-08-18 | Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote | |
CVE-2026-74044 |
high | 7.0 | 0.0060 | 2026-08-18 | Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster | |
CVE-2026-74031 |
high | 7.0 | 0.0051 | 2026-10-13 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and d | |
CVE-2026-114399 |
high | 7.0 | 0.0051 | 2026-10-21 | Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete | |
CVE-2026-114492 |
high | 7.0 | 0.0051 | 2026-10-21 | gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated admini | |
CVE-2026-81028 |
medium | 6.9 | 0.0052 | 2026-08-26 | ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix compa | |
CVE-2026-116800 |
medium | 6.9 | 0.0051 | 2026-10-27 | WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated | |
CVE-2026-117566 |
medium | 6.9 | 0.0035 | 2026-10-27 | EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php | |
CVE-2026-2399 |
medium | 6.9 | 0.0020 | 2026-04-14 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability | |
CVE-2026-6940 |
medium | 6.9 | 0.0022 | 2026-04-23 | radare2 prior to 6.1.4 contains a path traversal vulnerability in project deletion that allows local | |
CVE-2026-6941 |
medium | 6.9 | 0.0022 | 2026-04-23 | radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that al | |
CVE-2026-41493 |
medium | 6.9 | 0.0039 | 2026-05-08 | YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was disco | |
CVE-2026-42888 |
medium | 6.9 | 0.0033 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the podcast creation | |
CVE-2026-42780 |
medium | 6.9 | 0.0089 | 2026-05-13 | A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated a | |
CVE-2026-44437 |
medium | 6.9 | 0.0020 | 2026-05-13 | The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to befo | |
CVE-2026-42598 |
medium | 6.9 | 0.0032 | 2026-05-14 | Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP se | |
CVE-2026-11844 |
medium | 6.9 | 0.0041 | 2026-06-12 | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Rea | |
CVE-2026-60089 |
medium | 6.9 | 0.0020 | 2026-07-10 | PraisonAI (pip package praisonaiagents) before 1.6.78 automatically loads defaults from a project-lo | |
CVE-2026-61432 |
medium | 6.9 | 0.0034 | 2026-07-10 | PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext | |
CVE-2026-61505 |
medium | 6.9 | 0.0052 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a | |
CVE-2026-15789 |
medium | 6.9 | 0.0031 | 2026-07-21 | A custom client can produce such an upload request to the BuildKit daemon that files can escape from | |
CVE-2026-66007 |
medium | 6.9 | 0.0055 | 2026-07-24 | Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-b | |
CVE-2026-65765 |
medium | 6.9 | 0.0047 | 2026-07-27 | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper | |
CVE-2026-54659 |
medium | 6.9 | 0.0054 | 2026-07-28 | Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/p | |
CVE-2026-67246 |
medium | 6.9 | 0.0046 | 2026-07-30 | A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs | |
CVE-2026-62992 |
medium | 6.9 | 0.0053 | 2026-08-07 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from app |