Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40258 |
critical | 9.1 | 0.0040 | 2026-04-17 | The Gramps Web API is a Python REST API for the genealogical research software Gramps. Versions 1.6. | |
CVE-2026-41691 |
critical | 9.1 | 0.0031 | 2026-05-07 | Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that a | |
CVE-2026-44542 |
critical | 9.1 | 0.0052 | 2026-05-14 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9- | |
CVE-2026-53519 |
critical | 9.1 | 0.0193 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prio | |
CVE-2026-50203 |
critical | 9.1 | 0.0063 | 2026-06-17 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)` | |
CVE-2026-40005 |
critical | 9.1 | 0.0054 | 2026-07-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-53486 |
critical | 9.1 | 0.0075 | 2026-07-14 | The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction | |
CVE-2026-47731 |
critical | 9.1 | 0.0089 | 2026-07-21 | The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS | |
CVE-2026-72569 |
critical | 9.1 | 0.0074 | 2026-08-10 | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated | |
CVE-2026-48024 |
critical | 9.1 | 0.0078 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-9827 |
critical | 9.1 | 0.0063 | 2026-10-20 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (versi | |
CVE-2026-90866 |
critical | 9.1 | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 202 | |
CVE-2026-90864 |
critical | 9.1 | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 202 | |
CVE-2026-64825 |
critical | 9.0 | 0.0058 | 2026-07-21 | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthentica | |
CVE-2026-58072 |
critical | 9.0 | 0.0053 | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management se | |
CVE-2026-47897 |
high | 8.9 | 0.0072 | 2026-07-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-47896 |
high | 8.9 | 0.0081 | 2026-07-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-44829 |
high | 8.8 | 0.0050 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling | |
CVE-2026-96275 |
high | 8.8 | 0.0049 | 2026-09-23 | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary loc | |
CVE-2026-86398 |
high | 8.8 | 0.0034 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-103407 |
high | 8.8 | 0.0023 | 2026-10-28 | An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Ju | |
CVE-2026-118619 |
high | 8.8 | 0.0053 | 2026-10-28 | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerabi | |
CVE-2026-49163 |
high | 8.8 | 0.0102 | 2026-08-06 | Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insigh | |
CVE-2026-65768 |
high | 8.8 | 0.0094 | 2026-08-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams fo | |
CVE-2026-102226 |
high | 8.8 | 0.0104 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business | |
CVE-2026-105727 |
high | 8.8 | 0.0104 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business | |
CVE-2026-108452 |
high | 8.8 | 0.0082 | 2026-10-15 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S | |
CVE-2026-69943 |
high | 8.8 | 0.0116 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S | |
CVE-2026-85634 |
high | 8.8 | 0.0041 | 2026-10-15 | A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core libra | |
CVE-2023-27534 |
high | 8.8 | 0.0244 | 2023-03-30 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) charac | |
CVE-2026-35050 |
high | 8.8 | 0.0044 | 2026-04-06 | text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4. | |
CVE-2026-39981 |
high | 8.8 | 0.0132 | 2026-04-09 | AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the ess | |
CVE-2026-42608 |
high | 8.8 | 0.0060 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability wi | |
CVE-2026-7474 |
high | 8.8 | 0.0816 | 2026-05-12 | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client h | |
CVE-2026-45230 |
high | 8.8 | 0.0063 | 2026-05-18 | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpo | |
CVE-2026-57296 |
high | 8.8 | 0.0083 | 2026-06-24 | Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences | |
CVE-2026-56445 |
high | 8.8 | 0.0064 | 2026-06-25 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datase | |
CVE-2026-58166 |
high | 8.8 | 0.0085 | 2026-06-30 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that | |
CVE-2026-52868 |
high | 8.8 | 0.0049 | 2026-06-30 | An unauthenticated attacker can read worklist records from a directory outside the intended per-AE w | |
CVE-2026-42200 |
high | 8.8 | 0.0066 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-53951 |
high | 8.8 | 0.0026 | 2026-07-08 | Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, t | |
CVE-2026-43637 |
high | 8.8 | 0.0066 | 2026-07-15 | Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to writ | |
CVE-2026-44177 |
high | 8.8 | 0.0177 | 2026-07-16 | Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, K | |
CVE-2026-7667 |
high | 8.8 | 0.0056 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow po | |
CVE-2026-47871 |
high | 8.8 | 0.0096 | 2026-07-18 | VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation | |
CVE-2026-65702 |
high | 8.8 | 0.0058 | 2026-07-23 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persi | |
CVE-2026-65921 |
high | 8.8 | 0.0059 | 2026-07-27 | A path validation weakness in archive extraction/write handling allows entries with traversal sequen | |
CVE-2026-60009 |
high | 8.8 | 0.0044 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f | |
CVE-2026-17556 |
high | 8.8 | 0.0080 | 2026-08-05 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti | |
CVE-2026-13105 |
high | 8.8 | 0.0050 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal expl |