Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2612)
CWE-79 (1785)
CWE-416 (1279)
CWE-862 (1161)
CWE-89 (1089)
CWE-22 (1005)
CWE-125 (861)
CWE-200 (838)
CWE-306 (831)
CWE-122 (821)
CWE-20 (786)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (601)
CWE-74 (599)
CWE-639 (533)
CWE-400 (512)
CWE-269 (499)
CWE-119 (494)
CWE-770 (429)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (320)
CWE-352 (271)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-48772 |
critical | 10.0 | 0.0023 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, | |
CVE-2026-58122 |
critical | 9.3 | 0.0037 | 2026-07-09 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthentic | |
CVE-2026-9561 |
high | 8.8 | 0.0028 | 2026-07-14 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the au | |
CVE-2026-64619 |
high | 8.7 | 0.0029 | 2026-07-20 | FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allo | |
CVE-2026-55641 |
high | 8.2 | 0.0033 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy re | |
CVE-2026-46415 |
high | 8.2 | 0.0023 | 2026-07-20 | The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate request | |
CVE-2026-63770 |
high | 8.2 | 0.0029 | 2026-07-20 | Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler tha | |
CVE-2026-59999 |
high | 7.5 | 0.0016 | 2026-07-08 | In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTun | |
CVE-2026-57942 |
medium | 6.9 | 0.0023 | 2026-06-29 | LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the | |
CVE-2026-50243 |
medium | 6.3 | 0.0011 | 2026-07-22 | In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' | |
CVE-2026-25552 |
medium | 6.3 | 0.0022 | 2026-07-31 | Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote att | |
CVE-2026-111934 |
medium | 6.3 | 0.0012 | 2026-10-17 | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware tha | |
CVE-2026-114474 |
medium | 5.9 | 0.0016 | 2026-10-21 | Use of a less trusted source for the envelope sender in the external-account download of Progressive | |
CVE-2026-118265 |
medium | 5.3 | 0.0014 | 2026-10-28 | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates wh | |
CVE-2026-59897 |
medium | 5.3 | 0.0018 | 2026-07-08 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 bef | |
CVE-2026-26927 |
medium | 5.1 | 0.0027 | 2026-04-02 | Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary | |
CVE-2026-54289 |
medium | 4.8 | 0.0018 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-112378 |
medium | 4.3 | 0.0012 | 2026-10-22 | GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 19.3.6, 19.4 bef | |
CVE-2026-46466 |
low | 2.7 | 0.0015 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-44046 |
low | 2.3 | 0.0047 | 2026-06-19 | Use of Less Trusted Source vulnerability in Apache APISIX. Attacker can take advantage of wolf-rbac |