Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-11847 |
medium | 5.3 | 0.0029 | 2026-06-12 | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Path Traversal v | |
CVE-2026-43872 |
medium | 5.3 | 0.0030 | 2026-06-12 | Actual is an open-source personal finance application. Prior to version 26.5.0, several endpoints ar | |
CVE-2026-12565 |
medium | 5.3 | 0.0021 | 2026-06-17 | The unarchive internal module's archive extraction commands perform no code-level validation on extr | |
CVE-2026-56138 |
medium | 5.3 | 0.0051 | 2026-06-19 | AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoi | |
CVE-2026-49342 |
medium | 5.3 | 0.0033 | 2026-06-19 | YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, | |
CVE-2026-29509 |
medium | 5.3 | 0.0037 | 2026-06-26 | Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patool | |
CVE-2026-57079 |
medium | 5.3 | 0.0040 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path t | |
CVE-2026-28705 |
medium | 5.3 | 0.0045 | 2026-07-03 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components whe | |
CVE-2026-14636 |
medium | 5.3 | 0.0038 | 2026-07-04 | A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4 | |
CVE-2026-58203 |
medium | 5.3 | 0.0019 | 2026-07-06 | pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecre | |
CVE-2026-15331 |
medium | 5.3 | 0.0044 | 2026-07-10 | A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the functio | |
CVE-2026-11944 |
medium | 5.3 | 0.0048 | 2026-07-14 | openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging s | |
CVE-2026-48049 |
medium | 5.3 | 0.0059 | 2026-07-17 | @hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/iner | |
CVE-2026-57716 |
medium | 5.3 | 0.0037 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions. | |
CVE-2026-65920 |
medium | 5.3 | 0.0040 | 2026-07-23 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _g | |
CVE-2026-61632 |
medium | 5.3 | 0.0040 | 2026-08-06 | PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up t | |
CVE-2026-73244 |
medium | 5.3 | 0.0044 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unau | |
CVE-2026-63134 |
medium | 5.3 | 0.0042 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protec | |
CVE-2026-66381 |
medium | 5.3 | 0.0039 | 2026-08-12 | A repository reader with cache-deploy permission may access content outside a configured upstream pa | |
CVE-2026-66384 |
medium | 5.3 | 0.0066 | 2026-08-12 | JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerabil | KEV |
CVE-2026-113664 |
medium | 5.3 | 0.0049 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-expo | |
CVE-2026-80067 |
medium | 5.3 | — | 2026-10-29 | MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allo | |
CVE-2026-80069 |
medium | 5.3 | — | 2026-10-29 | MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability th | |
CVE-2026-90871 |
medium | 5.3 | — | 2026-10-29 | Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versi | |
CVE-2026-114377 |
medium | 5.1 | 0.0040 | 2026-10-21 | A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this | |
CVE-2026-42213 |
medium | 5.1 | 0.0056 | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCA | |
CVE-2026-53906 |
medium | 5.1 | 0.0052 | 2026-07-01 | MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to da | |
CVE-2026-53457 |
medium | 5.1 | 0.0076 | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5. | |
CVE-2026-40256 |
medium | 5.0 | 0.0032 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation | |
CVE-2026-59152 |
medium | 5.0 | 0.0020 | 2026-07-06 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an | |
CVE-2026-104743 |
medium | 4.9 | 0.0084 | 2026-10-28 | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in | |
CVE-2026-20174 |
medium | 4.9 | 0.0050 | 2026-04-01 | A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an auth | |
CVE-2026-20148 |
medium | 4.9 | 0.0654 | 2026-04-15 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perf | |
CVE-2026-25525 |
medium | 4.9 | 0.0050 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-4917 |
medium | 4.9 | 0.0036 | 2026-04-23 | IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the | |
CVE-2026-41887 |
medium | 4.9 | 0.0047 | 2026-05-08 | Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CV | |
CVE-2026-53594 |
medium | 4.9 | 0.0042 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Mana | |
CVE-2026-66476 |
medium | 4.9 | 0.0050 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. | |
CVE-2026-71283 |
medium | 4.9 | 0.0043 | 2026-08-05 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restor | |
CVE-2026-72773 |
medium | 4.9 | 0.0057 | 2026-08-11 | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-us | |
CVE-2026-73383 |
medium | 4.9 | 0.0047 | 2026-08-18 | Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions. | |
CVE-2025-69904 |
medium | 4.9 | 0.0047 | 2026-09-11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read | |
CVE-2026-106494 |
medium | 4.9 | 0.0031 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backe | |
CVE-2026-24147 |
medium | 4.8 | 0.0048 | 2026-04-07 | NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause | |
CVE-2026-47091 |
medium | 4.8 | 0.0013 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that a | |
CVE-2026-56377 |
medium | 4.8 | 0.0016 | 2026-06-30 | ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or tr | |
CVE-2026-19046 |
medium | 4.8 | 0.0020 | 2026-08-06 | A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted elem | |
CVE-2026-19336 |
medium | 4.8 | 0.0020 | 2026-08-09 | A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function | |
CVE-2026-19368 |
medium | 4.8 | 0.0017 | 2026-08-09 | A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown func | |
CVE-2026-115800 |
medium | 4.8 | 0.0014 | 2026-10-23 | A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the f |