Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-13622 |
high | 8.8 | 0.0020 | 2026-08-12 | A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live | |
CVE-2026-50186 |
high | 8.8 | 0.0059 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an au | |
CVE-2026-52872 |
high | 8.8 | 0.0018 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2 | |
CVE-2026-102217 |
high | 8.8 | 0.0126 | 2026-10-13 | Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privilege | |
CVE-2026-53995 |
high | 8.8 | 0.0060 | 2026-10-19 | MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend | |
CVE-2026-114140 |
high | 8.8 | 0.0038 | 2026-10-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja | |
CVE-2022-51022 |
high | 8.8 | 0.0079 | 2026-10-22 | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vuln | |
CVE-2026-55888 |
high | 8.8 | 0.0038 | 2026-10-23 | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed app | |
CVE-2026-116067 |
high | 8.8 | 0.0169 | 2026-10-25 | Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, | |
CVE-2026-110244 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitiv | |
CVE-2024-58312 |
high | 8.7 | 0.0120 | 2025-12-11 | xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to acce | |
CVE-2026-64966 |
high | 8.7 | 0.0072 | 2026-08-20 | ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker | |
CVE-2012-20002 |
high | 8.7 | 0.0053 | 2026-10-20 | TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability | |
CVE-2015-20123 |
high | 8.7 | 0.0041 | 2026-10-20 | Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that all | |
CVE-2015-20125 |
high | 8.7 | 0.0041 | 2026-10-20 | Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that all | |
CVE-2016-20103 |
high | 8.7 | 0.0061 | 2026-10-20 | Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthe | |
CVE-2025-71437 |
high | 8.7 | 0.0034 | 2026-10-21 | Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar e | |
CVE-2026-114063 |
high | 8.7 | 0.0040 | 2026-10-21 | SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vi | |
CVE-2026-114094 |
high | 8.7 | 0.0095 | 2026-10-21 | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Window | |
CVE-2026-114106 |
high | 8.7 | 0.0043 | 2026-10-21 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remot | |
CVE-2026-114109 |
high | 8.7 | 0.0038 | 2026-10-21 | uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write file | |
CVE-2026-114126 |
high | 8.7 | 0.0053 | 2026-10-21 | Storybook is a frontend workshop for building user interface components and pages in isolation. From | |
CVE-2017-20287 |
high | 8.7 | 0.0070 | 2026-10-22 | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unaut | |
CVE-2018-25438 |
high | 8.7 | 0.0054 | 2026-10-22 | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability i | |
CVE-2024-58396 |
high | 8.7 | 0.0050 | 2026-10-22 | YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerability that allows unaut | |
CVE-2026-116191 |
high | 8.7 | 0.0039 | 2026-10-25 | Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthentic | |
CVE-2026-112350 |
high | 8.7 | 0.0095 | 2026-10-27 | Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpo | |
CVE-2025-34181 |
high | 8.7 | 0.0104 | 2025-12-15 | NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity S | |
CVE-2026-40876 |
high | 8.7 | 0.0044 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape | |
CVE-2026-40062 |
high | 8.7 | 0.0062 | 2026-04-23 | A path Traversal vulnerability exists in Ziostation2 v2.9.8.7 and earlier. A remote unauthenticated | |
CVE-2026-6903 |
high | 8.7 | 0.0034 | 2026-04-23 | The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in | |
CVE-2026-42275 |
high | 8.7 | 0.0033 | 2026-05-08 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the | |
CVE-2026-7807 |
high | 8.7 | 0.0030 | 2026-05-08 | SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /a | |
CVE-2026-34653 |
high | 8.7 | 0.0061 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-44307 |
high | 8.7 | 0.0074 | 2026-05-12 | Mako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash tra | |
CVE-2026-48544 |
high | 8.7 | 0.0052 | 2026-05-27 | Taipy 4.1.1, fixed in commit 129fd40, contains a path traversal vulnerability in the ElementLibrary. | |
CVE-2026-44593 |
high | 8.7 | 0.0044 | 2026-05-28 | esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the leg | |
CVE-2026-32847 |
high | 8.7 | 0.0038 | 2026-05-28 | DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route i | |
CVE-2026-49128 |
high | 8.7 | 0.0064 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a path traversal vulnerability in LocalSto | |
CVE-2026-50234 |
high | 8.7 | 0.0078 | 2026-06-05 | Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attack | |
CVE-2026-45171 |
high | 8.7 | 0.0054 | 2026-06-11 | Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses | |
CVE-2026-48716 |
high | 8.7 | 0.0033 | 2026-06-18 | nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge | |
CVE-2026-53779 |
high | 8.7 | 0.0059 | 2026-06-22 | WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthe | |
CVE-2026-56122 |
high | 8.7 | 0.0055 | 2026-06-25 | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthent | |
CVE-2026-40521 |
high | 8.7 | 0.0098 | 2026-06-29 | FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handl | |
CVE-2026-49119 |
high | 8.7 | 0.0069 | 2026-07-01 | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preproce | |
CVE-2026-54406 |
high | 8.7 | 0.0059 | 2026-07-02 | A malicious actor with access to the network and high privileges could exploit a Path Traversal vuln | |
CVE-2026-49970 |
high | 8.7 | 0.0103 | 2026-07-13 | Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() fu | |
CVE-2026-57856 |
high | 8.7 | 0.0048 | 2026-07-13 | Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/ | |
CVE-2026-60114 |
high | 8.7 | 0.0050 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability |