Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-61666 |
high | 8.9 | 0.0044 | 2026-08-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driv | |
CVE-2024-58368 |
high | 8.7 | 0.0065 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API r | |
CVE-2026-111107 |
high | 8.7 | 0.0036 | 2026-10-27 | A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management interface allows a r | |
CVE-2026-114102 |
high | 8.7 | 0.0046 | 2026-10-21 | adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attacker | |
CVE-2026-119052 |
high | 8.7 | — | 2026-10-29 | llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server th | |
CVE-2026-116589 |
high | 8.2 | 0.0033 | 2026-10-26 | Datadog dd-trace-py is the Datadog Python APM client. From 3.13.0 until 4.15.5, the IAST string-proc | |
CVE-2026-42268 |
high | 8.2 | 0.0040 | 2026-05-12 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS | |
CVE-2026-50328 |
high | 7.5 | 0.0123 | 2026-07-14 | Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampe | |
CVE-2026-96945 |
high | 7.5 | 0.0105 | 2026-10-13 | Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over | |
CVE-2026-70082 |
high | 7.5 | 0.0133 | 2026-10-13 | Uncaught exception in Windows DNS allows an unauthorized attacker to deny service over a network. | |
CVE-2026-24175 |
high | 7.5 | 0.0047 | 2026-04-07 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash | |
CVE-2026-42544 |
high | 7.5 | 0.0039 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker | |
CVE-2026-59892 |
high | 7.5 | 0.0056 | 2026-07-08 | OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/prop | |
CVE-2026-58208 |
high | 7.5 | 0.0060 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr | |
CVE-2026-47480 |
high | 7.5 | 0.0049 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an unc | |
CVE-2026-48068 |
high | 7.5 | 0.0088 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P | |
CVE-2026-48069 |
high | 7.5 | 0.0088 | 2026-07-14 | @grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. P | |
CVE-2026-64612 |
high | 7.5 | 0.0070 | 2026-07-20 | A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng | |
CVE-2026-47219 |
high | 7.5 | 0.0046 | 2026-07-28 | find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports ro | |
CVE-2026-52856 |
high | 7.5 | 0.0061 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. | |
CVE-2026-76493 |
high | 7.5 | 0.0036 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa | |
CVE-2026-111181 |
high | 7.5 | 0.0039 | 2026-10-22 | body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in ver | |
CVE-2026-113872 |
high | 7.5 | 0.0044 | 2026-10-22 | multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2 | |
CVE-2026-119188 |
high | 7.5 | — | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2024-58357 |
high | 7.1 | 0.0045 | 2026-07-18 | SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() func | |
CVE-2024-58359 |
high | 7.1 | 0.0045 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism w | |
CVE-2024-58361 |
high | 7.1 | 0.0045 | 2026-07-18 | SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser e | |
CVE-2024-58364 |
high | 7.1 | 0.0045 | 2026-07-18 | SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span renderi | |
CVE-2024-58365 |
high | 7.1 | 0.0045 | 2026-07-18 | SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor wh | |
CVE-2024-58369 |
high | 7.1 | 0.0045 | 2026-07-18 | SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functi | |
CVE-2026-114051 |
high | 7.1 | 0.0037 | 2026-10-21 | vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with | |
CVE-2025-71391 |
high | 7.1 | 0.0056 | 2026-07-18 | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that a | |
CVE-2024-58358 |
medium | 6.9 | 0.0047 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that al | |
CVE-2026-117541 |
medium | 6.9 | 0.0031 | 2026-10-27 | svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows atta | |
CVE-2026-59162 |
medium | 6.9 | 0.0066 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1 | |
CVE-2026-89312 |
medium | 6.9 | 0.0028 | 2026-10-23 | `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking | |
CVE-2026-89315 |
medium | 6.9 | 0.0025 | 2026-10-23 | `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field n | |
CVE-2026-89318 |
medium | 6.9 | 0.0017 | 2026-10-23 | `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Op | |
CVE-2026-72813 |
medium | 6.9 | 0.0049 | 2026-08-14 | actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range hea | |
CVE-2026-65834 |
medium | 6.8 | 0.0032 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfig | |
CVE-2026-54908 |
medium | 6.3 | 0.0054 | 2026-07-01 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are v | |
CVE-2026-89316 |
medium | 6.3 | 0.0021 | 2026-10-23 | `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*EC | |
CVE-2026-88099 |
medium | 5.9 | 0.0082 | 2026-10-13 | Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over | |
CVE-2026-42545 |
medium | 5.9 | 0.0027 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker | |
CVE-2026-115892 |
medium | 5.7 | 0.0043 | 2026-10-23 | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created | |
CVE-2026-34943 |
medium | 5.6 | 0.0032 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contain | |
CVE-2026-35348 |
medium | 5.5 | 0.0013 | 2026-04-22 | The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from o | |
CVE-2026-5937 |
medium | 5.5 | 0.0010 | 2026-04-27 | Insufficient parameter verification leads to the occurrence of format errors in files, which will tr | |
CVE-2026-59875 |
medium | 5.3 | 0.0035 | 2026-07-08 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip | |
CVE-2026-48038 |
medium | 5.3 | 0.0052 | 2026-07-14 | joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, |