Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-116046 |
medium | 4.8 | 0.0014 | 2026-10-25 | A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getC | |
CVE-2026-35613 |
medium | 4.7 | 0.0014 | 2026-04-07 | coursevault-preview is a utility for previewing course material files from a configured directory. c | |
CVE-2026-42078 |
medium | 4.6 | 0.0020 | 2026-05-04 | PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTA | |
CVE-2026-42080 |
medium | 4.6 | 0.0020 | 2026-05-04 | PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, ther | |
CVE-2026-41530 |
medium | 4.6 | 0.0015 | 2026-05-12 | The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path tra | |
CVE-2026-49497 |
medium | 4.6 | 0.0019 | 2026-06-10 | Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to | |
CVE-2026-66484 |
medium | 4.6 | 0.0020 | 2026-08-10 | GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When e | |
CVE-2026-113719 |
medium | 4.5 | 0.0020 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall | |
CVE-2026-42549 |
medium | 4.4 | 0.0020 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command ca | |
CVE-2026-39489 |
medium | 4.4 | 0.0034 | 2026-06-15 | Author Arbitrary File Download in Download Monitor <= 5.1.9 versions. | |
CVE-2026-41124 |
medium | 4.4 | 0.0017 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through | |
CVE-2026-46671 |
medium | 4.4 | 0.0015 | 2026-07-20 | Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to versi | |
CVE-2026-118667 |
medium | 4.3 | 0.0039 | 2026-10-28 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads | |
CVE-2026-33227 |
medium | 4.3 | 0.0042 | 2026-04-07 | Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Cli | |
CVE-2026-33929 |
medium | 4.3 | 0.0071 | 2026-04-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-42885 |
medium | 4.3 | 0.0028 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesys | |
CVE-2026-41009 |
medium | 4.3 | 0.0010 | 2026-05-27 | When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is con | |
CVE-2026-10601 |
medium | 4.3 | 0.0029 | 2026-06-22 | A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source | |
CVE-2026-48789 |
medium | 4.3 | 0.0034 | 2026-06-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as refe | |
CVE-2026-8662 |
medium | 4.3 | 0.0029 | 2026-06-25 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plu | |
CVE-2026-46338 |
medium | 4.3 | 0.0040 | 2026-07-16 | PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 unti | |
CVE-2026-15160 |
medium | 4.3 | 0.0066 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all vers | |
CVE-2026-66382 |
medium | 4.3 | 0.0035 | 2026-08-12 | An authenticated user may write files outside the intended Artifactory work directory under specific | |
CVE-2026-18106 |
medium | 4.3 | 0.0050 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa | |
CVE-2026-53584 |
medium | 4.3 | 0.0033 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a | |
CVE-2026-107745 |
medium | 4.2 | 0.0032 | 2026-10-28 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to | |
CVE-2026-54319 |
medium | 4.2 | 0.0024 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-41861 |
medium | 4.2 | 0.0021 | 2026-08-06 | Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a r | |
CVE-2026-106493 |
medium | 4.1 | 0.0028 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalo | |
CVE-2025-65713 |
medium | 4.0 | 0.0040 | 2025-12-23 | Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integratio | |
CVE-2026-16888 |
low | 3.7 | 0.0050 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info | |
CVE-2026-114370 |
low | 3.7 | 0.0032 | 2026-10-21 | A flaw was found in the PathResourceManager component of the Undertow web server. This component is | |
CVE-2026-104312 |
low | 3.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-gene | |
CVE-2026-113731 |
low | 3.3 | 0.0019 | 2026-10-20 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe | |
CVE-2026-116673 |
low | 3.3 | 0.0013 | 2026-10-27 | systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux ne | |
CVE-2023-27409 |
low | 3.3 | 0.0017 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vuln | |
CVE-2026-29051 |
low | 3.3 | 0.0017 | 2026-04-24 | melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 a | |
CVE-2026-115569 |
low | 3.3 | 0.0019 | 2026-10-23 | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fall | |
CVE-2026-14967 |
low | 3.1 | 0.0026 | 2026-07-08 | BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configu | |
CVE-2023-29128 |
low | 2.7 | 0.0068 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), | |
CVE-2026-53480 |
low | 2.7 | 0.0035 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-12660 |
low | 2.7 | 0.0024 | 2026-10-19 | IBM MQ Web Console could allow an authenticated administrator to write files outside the intended di | |
CVE-2026-15687 |
low | 2.4 | 0.0038 | 2026-07-23 | A security issue was discovered in the Kubernetes Java client library where a compromised pod may be | |
CVE-2026-64963 |
low | 2.3 | 0.0053 | 2026-08-20 | A path traversal vulnerability in ATutor allows an authenticated user to access files from other cou | |
CVE-2026-58171 |
low | 2.3 | 0.0034 | 2026-06-30 | Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run ident | |
CVE-2026-93571 |
low | 2.3 | — | 2026-10-29 | Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who ca | |
CVE-2025-71394 |
low | 2.3 | 0.0037 | 2026-07-18 | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER state | |
CVE-2026-113743 |
low | 2.1 | 0.0044 | 2026-10-21 | A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the fun | |
CVE-2026-117510 |
low | 2.1 | 0.0049 | 2026-10-27 | A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function | |
CVE-2026-6487 |
low | 2.1 | 0.0037 | 2026-04-17 | A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/c |