Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-96207 |
critical | 10.0 | 0.0067 | 2026-10-08 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to eleva | |
CVE-2026-4370 |
critical | 10.0 | 0.0038 | 2026-04-01 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4. | |
CVE-2026-17024 |
critical | 9.8 | 0.0035 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod | |
CVE-2026-20184 |
critical | 9.8 | 0.0052 | 2026-04-15 | A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services | |
CVE-2026-59836 |
critical | 9.8 | 0.0022 | 2026-07-14 | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, Fort | |
CVE-2026-22093 |
critical | 9.5 | 0.0026 | 2026-07-13 | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the ce | |
CVE-2026-13385 |
critical | 9.5 | 0.0014 | 2026-07-15 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS | |
CVE-2026-16822 |
critical | 9.3 | 0.0025 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC p | |
CVE-2026-114220 |
critical | 9.3 | 0.0019 | 2026-10-22 | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unaut | |
CVE-2026-114611 |
critical | 9.1 | 0.0023 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deploym | |
CVE-2026-115216 |
critical | 9.1 | 0.0024 | 2026-10-27 | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when | |
CVE-2026-33896 |
critical | 9.1 | 0.0036 | 2026-03-27 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScrip | |
CVE-2026-5787 |
critical | 9.1 | 0.0069 | 2026-05-07 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 a | |
CVE-2026-7821 |
critical | 9.1 | 0.0051 | 2026-05-07 | Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allo | |
CVE-2026-41872 |
critical | 9.1 | 0.0016 | 2026-05-12 | "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate validation. A | |
CVE-2026-6900 |
critical | 9.1 | 0.0022 | 2026-07-06 | Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue a | |
CVE-2026-48021 |
critical | 9.1 | 0.0019 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between ep | |
CVE-2026-64993 |
critical | 9.1 | 0.0024 | 2026-08-06 | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in t | |
CVE-2026-71290 |
critical | 9.1 | 0.0033 | 2026-08-11 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. Hostn | |
CVE-2026-52723 |
critical | 9.1 | 0.0038 | 2026-08-18 | ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to | |
CVE-2026-105216 |
critical | 9.1 | 0.0019 | 2026-10-04 | go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network | |
CVE-2026-105222 |
critical | 9.1 | 0.0019 | 2026-10-04 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by | |
CVE-2026-105223 |
critical | 9.1 | 0.0020 | 2026-10-05 | maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconf | |
CVE-2026-107685 |
critical | 9.1 | 0.0027 | 2026-10-23 | Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm | |
CVE-2026-115693 |
critical | 9.1 | 0.0027 | 2026-10-26 | Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path at | |
CVE-2026-47632 |
high | 8.8 | 0.0050 | 2026-07-14 | Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to | |
CVE-2026-23776 |
high | 8.8 | 0.0022 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions | |
CVE-2026-44700 |
high | 8.7 | 0.0026 | 2026-05-14 | Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing | |
CVE-2026-47074 |
high | 8.7 | 0.0023 | 2026-05-28 | Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCa | |
CVE-2026-45175 |
high | 8.5 | 0.0013 | 2026-06-11 | Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within | |
CVE-2026-66154 |
high | 8.3 | 0.0020 | 2026-08-11 | An insufficient certificate validation in a privileged communication workflow, was identified in a G | |
CVE-2026-42013 |
high | 8.2 | 0.0042 | 2026-05-26 | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN | |
CVE-2026-103602 |
high | 8.2 | 0.0029 | 2026-10-02 | Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. b | |
CVE-2026-63576 |
high | 8.2 | 0.0026 | 2026-10-02 | Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the | |
CVE-2026-63577 |
high | 8.2 | 0.0024 | 2026-10-02 | Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValida | |
CVE-2026-42225 |
high | 8.2 | 0.0016 | 2026-05-07 | PJSIP is a free and open source multimedia communication library written in C. Prior to version 2.17 | |
CVE-2026-32992 |
high | 8.2 | 0.0025 | 2026-05-13 | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to m | |
CVE-2026-23998 |
high | 8.2 | 0.0021 | 2026-05-14 | Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s | |
CVE-2026-48246 |
high | 8.2 | 0.0017 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting | |
CVE-2026-13410 |
high | 8.2 | 0.0038 | 2026-07-17 | Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled. The defa | |
CVE-2026-15078 |
high | 8.1 | 0.0032 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized | |
CVE-2026-22747 |
high | 8.1 | 0.0024 | 2026-04-22 | Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle cer | |
CVE-2026-59818 |
high | 8.1 | 0.0043 | 2026-07-08 | etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6. | |
CVE-2026-54342 |
high | 8.1 | 0.0020 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any bac | |
CVE-2026-18129 |
high | 8.1 | 0.0146 | 2026-08-11 | Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before versio | |
CVE-2026-45745 |
high | 8.0 | 0.0017 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-60648 |
high | 8.0 | 0.0018 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-55001 |
high | 7.8 | 0.0030 | 2026-07-14 | Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate | |
CVE-2026-46734 |
high | 7.8 | 0.0009 | 2026-06-25 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certifica | |
CVE-2026-111814 |
high | 7.8 | 0.0024 | 2026-10-21 | Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authe |