Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2612)
CWE-79 (1782)
CWE-416 (1279)
CWE-862 (1155)
CWE-89 (1089)
CWE-22 (1005)
CWE-125 (861)
CWE-200 (838)
CWE-306 (831)
CWE-122 (821)
CWE-20 (786)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (601)
CWE-74 (599)
CWE-639 (531)
CWE-400 (512)
CWE-269 (499)
CWE-119 (494)
CWE-770 (429)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42791 |
medium | 6.3 | 0.0032 | 2026-05-27 | Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows f | |
CVE-2026-65325 |
medium | 6.3 | 0.0028 | 2026-07-29 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server cert | |
CVE-2026-106017 |
medium | 6.3 | 0.0020 | 2026-10-22 | Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows atta | |
CVE-2026-115996 |
medium | 6.3 | 0.0023 | 2026-10-24 | A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This af | |
CVE-2026-0248 |
medium | 6.2 | 0.0019 | 2026-05-13 | An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome | |
CVE-2026-41022 |
medium | 5.9 | 0.0008 | 2026-10-27 | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent | |
CVE-2023-25392 |
medium | 5.9 | 0.0043 | 2023-04-10 | Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation. | |
CVE-2023-28321 |
medium | 5.9 | 0.0181 | 2023-05-26 | An improper certificate validation vulnerability exists in curl <v8.1.0 in the way it supports match | |
CVE-2026-41016 |
medium | 5.9 | 0.0027 | 2026-04-30 | Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL c | |
CVE-2026-54323 |
medium | 5.9 | 0.0019 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-16107 |
medium | 5.9 | 0.0020 | 2026-07-28 | IBM TS4500 CLI tool Versions: 0.1.31 through 1.12.0.0 does not validate or improperly validates TLS | |
CVE-2026-44363 |
medium | 5.8 | 0.0010 | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7 | |
CVE-2026-44312 |
medium | 5.8 | 0.0015 | 2026-05-14 | css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTT | |
CVE-2026-18679 |
medium | 5.8 | 0.0016 | 2026-08-12 | When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificat | |
CVE-2026-0277 |
medium | 5.7 | 0.0020 | 2026-07-09 | An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an atta | |
CVE-2026-18257 |
medium | 5.6 | 0.0015 | 2026-07-29 | Improper validity period check for root issuer certificate in CycloneCrypto cryptographic wrapper of | |
CVE-2026-39984 |
medium | 5.5 | 0.0010 | 2026-04-15 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below | |
CVE-2026-18678 |
medium | 5.5 | 0.0013 | 2026-08-12 | When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, | |
CVE-2026-35207 |
medium | 5.4 | 0.0015 | 2026-04-09 | dde-control-center is the control panel of DDE, the Deepin Desktop Environment. plugin-deepinid is a | |
CVE-2026-8367 |
medium | 5.3 | 0.0013 | 2026-05-13 | aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compro | |
CVE-2026-44309 |
medium | 5.3 | 0.0014 | 2026-05-15 | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. Pr | |
CVE-2026-0244 |
medium | 5.2 | 0.0022 | 2026-05-13 | An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables | |
CVE-2026-42213 |
medium | 5.1 | 0.0056 | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCA | |
CVE-2026-63336 |
medium | 5.1 | 0.0031 | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w | |
CVE-2026-0249 |
medium | 4.9 | 0.0011 | 2026-05-13 | Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ ap | |
CVE-2026-40557 |
medium | 4.8 | 0.0019 | 2026-04-27 | Improper Certificate Validation via Global SSL Context Downgrade in Apache Storm Prometheus Reporter | |
CVE-2026-57289 |
medium | 4.8 | 0.0016 | 2026-06-24 | Jenkins Bitbucket Push and Pull Request Plugin 3.3.8 and earlier unconditionally disables SSL/TLS ce | |
CVE-2026-87944 |
medium | 4.8 | 0.0014 | 2026-10-22 | Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversar | |
CVE-2026-96375 |
medium | 4.8 | 0.0012 | 2026-10-22 | Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). | |
CVE-2026-0296 |
medium | 4.5 | 0.0026 | 2026-08-13 | Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an u | |
CVE-2026-83926 |
medium | 4.4 | 0.0039 | 2026-10-13 | Improper certificate validation in Windows Hello allows an authorized attacker to bypass a security | |
CVE-2026-48934 |
medium | 4.3 | 0.0026 | 2026-06-26 | A flaw in Node.js TLS host verification can cause an attacker to bypass certification validation. | |
CVE-2026-8480 |
medium | 4.3 | 0.0013 | 2026-07-01 | A vulnerability was discovered on Stormshield Network Security 4.3.0 to 4.3.41 (included), 4.4.0 to | |
CVE-2026-50302 |
medium | 4.2 | 0.0033 | 2026-07-14 | Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to | |
CVE-2026-91461 |
low | 3.7 | 0.0019 | 2026-10-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-88648 |
low | 3.7 | 0.0020 | 2026-10-08 | Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certifi | |
CVE-2023-34414 |
low | 3.1 | 0.0090 | 2023-06-19 | The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses | |
CVE-2026-40243 |
low | 2.3 | 0.0017 | 2026-05-06 | Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS valida | |
CVE-2026-0233 |
low | 2.0 | 0.0018 | 2026-04-13 | A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager o | |
CVE-2026-4740 |
— | — | 0.0015 | 2026-04-07 | A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluste | |
CVE-2026-43869 |
— | — | 0.0063 | 2026-05-05 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue af | |
CVE-2026-85102 |
— | — | 0.5414 | — | Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access | KEV |
CVE-2026-86881 |
— | — | 0.0040 | 2026-09-14 | A certificate validation issue was addressed with improved certificate validation. This issue is fix | |
CVE-2026-86889 |
— | — | 0.0020 | 2026-09-14 | A certificate validation issue was addressed with improved certificate validation. This issue is fix | |
CVE-2026-113812 |
— | — | 0.0015 | 2026-10-20 | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root link | |
CVE-2026-105031 |
— | — | — | 2026-10-29 | When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_confi |