Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-6508 |
critical | 9.8 | 0.0022 | 2026-05-07 | Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Lid | |
CVE-2026-16349 |
critical | 9.8 | 0.0030 | 2026-07-21 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox | |
CVE-2026-16358 |
critical | 9.8 | 0.0030 | 2026-07-21 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1 | |
CVE-2026-16375 |
critical | 9.8 | 0.0029 | 2026-07-21 | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, | |
CVE-2026-16387 |
critical | 9.8 | 0.0028 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firef | |
CVE-2026-18847 |
critical | 9.8 | 0.0025 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials du | |
CVE-2026-15587 |
critical | 9.4 | 0.0023 | 2026-08-05 | Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google C | |
CVE-2026-54030 |
critical | 9.3 | 0.0017 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreCha | |
CVE-2026-52842 |
critical | 9.3 | 0.0025 | 2026-07-15 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpanda searched | |
CVE-2026-52843 |
critical | 9.3 | 0.0023 | 2026-07-15 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpanda fetch() | |
CVE-2026-54069 |
critical | 9.2 | 0.0747 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel | |
CVE-2026-12304 |
critical | 9.1 | 0.0019 | 2026-06-16 | Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Fire | |
CVE-2026-16381 |
critical | 9.1 | 0.0023 | 2026-07-21 | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox | |
CVE-2026-109772 |
critical | 9.1 | 0.0018 | 2026-10-13 | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and | |
CVE-2026-61546 |
high | 8.8 | 0.0018 | 2026-10-28 | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the | |
CVE-2026-42559 |
high | 8.8 | 0.0027 | 2026-05-14 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate' | |
CVE-2026-46728 |
high | 8.8 | 0.0021 | 2026-05-16 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed- | |
CVE-2026-16745 |
high | 8.8 | 0.0046 | 2026-07-23 | A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to | |
CVE-2026-6903 |
high | 8.7 | 0.0034 | 2026-04-23 | The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in | |
CVE-2026-114125 |
high | 8.6 | 0.0039 | 2026-10-21 | Storybook is a frontend workshop for building user interface components and pages in isolation. From | |
CVE-2026-47825 |
high | 8.6 | 0.0018 | 2026-06-15 | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxie | |
CVE-2026-13321 |
high | 8.6 | 0.0021 | 2026-07-22 | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outs | |
CVE-2026-66298 |
high | 8.6 | 0.0027 | 2026-08-05 | Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output Java | |
CVE-2026-58497 |
high | 8.6 | 0.0026 | 2026-10-23 | Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, | |
CVE-2026-45173 |
high | 8.4 | 0.0016 | 2026-06-11 | Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit | |
CVE-2026-56179 |
high | 8.3 | 0.0028 | 2026-08-11 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker | |
CVE-2026-56181 |
high | 8.3 | 0.0028 | 2026-07-14 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker | |
CVE-2026-66732 |
high | 8.3 | 0.0017 | 2026-08-06 | Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in C | |
CVE-2026-59096 |
high | 8.2 | 0.0034 | 2026-07-02 | Dapr Sentry's OIDC discovery endpoint derives the issuer and jwks_uri of the /.well-known/openid-con | |
CVE-2026-15075 |
high | 8.2 | 0.0020 | 2026-07-14 | In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRe | |
CVE-2026-15076 |
high | 8.2 | 0.0020 | 2026-07-14 | In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession com | |
CVE-2026-112085 |
high | 8.2 | 0.0015 | 2026-10-22 | webpack-dev-server is a development server that provides live reloading for webpack projects. In ver | |
CVE-2026-79977 |
high | 8.2 | 0.0017 | 2026-10-23 | The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message | |
CVE-2026-55587 |
high | 8.1 | 0.0015 | 2026-10-15 | AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the Al | |
CVE-2026-66318 |
high | 8.1 | 0.0036 | 2026-08-03 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo | |
CVE-2026-35577 |
high | 8.1 | 0.0018 | 2026-04-09 | Apollo MCP Server is a Model Context Protocol server that exposes GraphQL operations as MCP tools. P | |
CVE-2026-18098 |
high | 8.1 | 0.0025 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa | |
CVE-2026-62442 |
high | 8.1 | 0.0026 | 2026-08-18 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C | |
CVE-2026-70213 |
high | 8.0 | 0.0039 | 2026-10-13 | Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a | |
CVE-2026-6102 |
high | 7.8 | 0.0012 | 2026-07-29 | MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulner | |
CVE-2026-58169 |
high | 7.7 | 0.0042 | 2026-06-30 | Vibe-Trading before 0.1.10 contains a DNS rebinding authentication bypass vulnerability that allows | |
CVE-2026-116194 |
high | 7.6 | 0.0012 | 2026-10-25 | Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud b | |
CVE-2026-59208 |
high | 7.6 | 0.0027 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, | |
CVE-2026-59950 |
high | 7.6 | 0.0023 | 2026-07-15 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC | |
CVE-2026-46701 |
high | 7.6 | 0.0021 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE ser | |
CVE-2026-82121 |
high | 7.5 | 0.0021 | 2026-10-27 | Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 1 | |
CVE-2026-16398 |
high | 7.5 | 0.0022 | 2026-07-21 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thun | |
CVE-2026-16399 |
high | 7.5 | 0.0022 | 2026-07-21 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 a | |
CVE-2026-17916 |
high | 7.5 | 0.0022 | 2026-07-30 | Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote | |
CVE-2026-60765 |
high | 7.5 | 0.0018 | 2026-08-18 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). S |