Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2612)
CWE-79 (1782)
CWE-416 (1279)
CWE-862 (1155)
CWE-89 (1089)
CWE-22 (1005)
CWE-125 (861)
CWE-200 (838)
CWE-306 (831)
CWE-122 (821)
CWE-20 (786)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (601)
CWE-74 (599)
CWE-639 (531)
CWE-400 (512)
CWE-269 (499)
CWE-119 (494)
CWE-770 (429)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-111815 |
high | 7.8 | 0.0024 | 2026-10-21 | Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a clien | |
CVE-2025-13833 |
high | 7.7 | 0.0015 | 2026-10-26 | A vulnerability exists in SecureConnector for Windows when the “Additional Appliance Connections” se | |
CVE-2026-118682 |
high | 7.7 | — | 2026-10-28 | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils | |
CVE-2026-29140 |
high | 7.7 | 0.0012 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to cause attacker-controlled | |
CVE-2026-111459 |
high | 7.6 | 0.0017 | 2026-10-27 | An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). U | |
CVE-2026-116641 |
high | 7.6 | — | 2026-10-28 | The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the s | |
CVE-2026-32144 |
high | 7.6 | 0.0020 | 2026-04-07 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows O | |
CVE-2026-42790 |
high | 7.6 | 0.0034 | 2026-05-27 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key m | |
CVE-2026-70454 |
high | 7.6 | 0.0019 | 2026-08-13 | rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS ce | |
CVE-2026-114047 |
high | 7.6 | 0.0019 | 2026-10-21 | FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its pr | |
CVE-2026-115929 |
high | 7.6 | 0.0019 | 2026-10-24 | MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate | |
CVE-2026-115930 |
high | 7.6 | 0.0014 | 2026-10-26 | The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root | |
CVE-2026-118040 |
high | 7.5 | — | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, improper verificat | |
CVE-2026-108131 |
high | 7.5 | 0.0086 | 2026-10-13 | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacke | |
CVE-2026-45170 |
high | 7.5 | 0.0010 | 2026-06-12 | Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and con | |
CVE-2026-15683 |
high | 7.5 | 0.0015 | 2026-07-13 | Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulne | |
CVE-2026-52688 |
high | 7.5 | 0.0018 | 2026-07-23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | |
CVE-2026-18089 |
high | 7.5 | 0.0023 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses aga | |
CVE-2026-50578 |
high | 7.5 | 0.0031 | 2026-08-18 | ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to | |
CVE-2026-42011 |
high | 7.4 | 0.0047 | 2026-05-07 | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorr | |
CVE-2026-96222 |
high | 7.4 | 0.0059 | 2026-10-13 | Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthoriz | |
CVE-2026-54919 |
high | 7.4 | 0.0026 | 2026-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed T | |
CVE-2026-8497 |
high | 7.4 | 0.0013 | 2026-07-29 | Improper certificate validation in the Devolutions Server connection handling in Devolutions Passwor | |
CVE-2026-105483 |
high | 7.4 | 0.0027 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN t | |
CVE-2026-106069 |
high | 7.4 | 0.0027 | 2026-10-23 | A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a | |
CVE-2026-9758 |
high | 7.3 | 0.0012 | 2026-06-10 | Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untru | |
CVE-2026-56624 |
high | 7.3 | 0.0029 | 2026-07-20 | Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java librar | |
CVE-2026-0392 |
high | 7.3 | 0.0009 | 2026-08-03 | eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates ove | |
CVE-2026-42012 |
high | 7.1 | 0.0035 | 2026-05-26 | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a speci | |
CVE-2026-117611 |
high | 7.1 | — | 2026-10-29 | Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Cert | |
CVE-2026-114642 |
high | 7.0 | 0.0019 | 2026-10-22 | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper | |
CVE-2026-42789 |
high | 7.0 | 0.0038 | 2026-05-27 | Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_ | |
CVE-2026-16792 |
high | 7.0 | 0.0011 | 2026-08-04 | An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrat | |
CVE-2026-6860 |
medium | 6.9 | 0.0024 | 2026-05-06 | A TCP client can perform a TLS handshake and present the server name extension with a server name th | |
CVE-2026-69248 |
medium | 6.9 | 0.0024 | 2026-08-03 | cryptography is a package designed to expose cryptographic primitives and recipes to Python develope | |
CVE-2026-114406 |
medium | 6.8 | 0.0031 | 2026-10-21 | The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM | |
CVE-2026-87880 |
medium | 6.8 | — | 2026-10-28 | Sensitive information disclosure due to missing SSL certificate verification affecting one component | |
CVE-2026-40970 |
medium | 6.8 | 0.0014 | 2026-04-27 | When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perfor | |
CVE-2026-44305 |
medium | 6.8 | 0.0014 | 2026-05-12 | Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = Tru | |
CVE-2026-41119 |
medium | 6.8 | 0.0014 | 2026-05-18 | Dell Live Optics Windows and Personal Edition collectors contain an improper certificate validation | |
CVE-2026-106072 |
medium | 6.7 | 0.0055 | 2026-10-23 | A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate | |
CVE-2026-108326 |
medium | 6.5 | 0.0018 | 2026-10-27 | Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. | |
CVE-2026-70194 |
medium | 6.5 | 0.0049 | 2026-10-13 | Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a securi | |
CVE-2023-0430 |
medium | 6.5 | 0.0037 | 2023-06-02 | Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed wit | |
CVE-2023-0547 |
medium | 6.5 | 0.0037 | 2023-06-02 | OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email | |
CVE-2026-20042 |
medium | 6.5 | 0.0029 | 2026-04-01 | A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker | |
CVE-2026-53583 |
medium | 6.5 | 0.0024 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a | |
CVE-2026-12374 |
medium | 6.4 | 0.0007 | 2026-07-01 | Improper certificate validation and a time-of-check time-of-use (TOCTOU) race condition in the Privi | |
CVE-2026-66760 |
medium | 6.4 | 0.0018 | 2026-08-11 | SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker | |
CVE-2026-34477 |
medium | 6.3 | 0.0056 | 2026-04-10 | The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: |