Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-0064 |
critical | 10.0 | 0.0012 | 2026-06-17 | In multiple places, there is a possible persistent denial of service due to resource exhaustion. Thi | |
CVE-2026-28575 |
critical | 10.0 | 0.0013 | 2026-06-17 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/Pac | |
CVE-2026-60719 |
critical | 9.9 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). | |
CVE-2026-61186 |
critical | 9.4 | 0.0041 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (compon | |
CVE-2026-55450 |
critical | 9.3 | 0.0119 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unaut | |
CVE-2026-46910 |
critical | 9.1 | 0.0035 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr | |
CVE-2026-60208 |
critical | 9.1 | 0.0045 | 2026-07-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-61155 |
critical | 9.1 | 0.0049 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (com | |
CVE-2026-97775 |
high | 8.8 | 0.0084 | 2026-10-13 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a netw | |
CVE-2024-58306 |
high | 8.7 | 0.0049 | 2025-12-11 | minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the w | |
CVE-2026-112400 |
high | 8.7 | 0.0059 | 2026-10-19 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame | |
CVE-2026-116177 |
high | 8.7 | 0.0029 | 2026-10-25 | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allo | |
CVE-2026-116878 |
high | 8.7 | 0.0037 | 2026-10-27 | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerabili | |
CVE-2026-3505 |
high | 8.7 | 0.0079 | 2026-04-15 | Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerabilit | |
CVE-2026-40192 |
high | 8.7 | 0.0067 | 2026-04-15 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP- | |
CVE-2026-41146 |
high | 8.7 | 0.0037 | 2026-04-22 | facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a9 | |
CVE-2026-41680 |
high | 8.7 | 0.0034 | 2026-04-24 | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) | |
CVE-2026-7790 |
high | 8.7 | 0.0043 | 2026-05-11 | Uncontrolled Resource Consumption vulnerability in ninenines cowlib (cow_http_te module) allows Exce | |
CVE-2026-45169 |
high | 8.7 | 0.0035 | 2026-06-12 | Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, an | |
CVE-2026-56248 |
high | 8.7 | 0.0043 | 2026-06-23 | Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerab | |
CVE-2026-49851 |
high | 8.7 | 0.0052 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerabl | |
CVE-2026-59936 |
high | 8.7 | 0.0062 | 2026-07-08 | pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PD | |
CVE-2026-15308 |
high | 8.7 | 0.0064 | 2026-07-09 | The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeat | |
CVE-2026-59161 |
high | 8.7 | 0.0066 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1 | |
CVE-2026-33445 |
high | 8.7 | 0.0040 | 2026-07-15 | CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attacke | |
CVE-2026-55685 |
high | 8.7 | 0.0071 | 2026-07-27 | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be | |
CVE-2026-69249 |
high | 8.7 | 0.0026 | 2026-08-03 | python-cryptography is a package designed to expose cryptographic primitives and recipes to Python d | |
CVE-2026-73413 |
high | 8.7 | 0.0059 | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the fl | |
CVE-2026-71491 |
high | 8.7 | 0.0026 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlpars | |
CVE-2026-114055 |
high | 8.7 | 0.0042 | 2026-10-21 | vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allow | |
CVE-2026-110803 |
high | 8.7 | 0.0028 | 2026-10-21 | VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request | |
CVE-2026-111810 |
high | 8.7 | 0.0036 | 2026-10-21 | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every | |
CVE-2026-108359 |
high | 8.7 | 0.0041 | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1 | |
CVE-2026-115348 |
high | 8.7 | 0.0044 | 2026-10-22 | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link | |
CVE-2026-115775 |
high | 8.7 | 0.0044 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.1 | |
CVE-2026-54609 |
high | 8.6 | 0.0046 | 2026-07-28 | QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0 | |
CVE-2026-93441 |
high | 8.6 | 0.0033 | 2026-10-20 | IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resou | |
CVE-2026-101459 |
high | 8.3 | 0.0039 | 2026-10-20 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastru | |
CVE-2026-101593 |
high | 8.3 | 0.0039 | 2026-10-20 | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply | |
CVE-2026-60582 |
high | 8.3 | 0.0038 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite ( | |
CVE-2026-91252 |
high | 8.2 | 0.0041 | 2026-10-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported | |
CVE-2026-96640 |
high | 8.2 | 0.0058 | 2026-10-21 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/ | |
CVE-2026-118260 |
high | 8.2 | — | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads comp | |
CVE-2026-118261 |
high | 8.2 | — | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes | |
CVE-2026-118664 |
high | 8.2 | — | 2026-10-28 | decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decod | |
CVE-2026-46866 |
high | 8.2 | 0.0039 | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c | |
CVE-2026-47046 |
high | 8.2 | 0.0041 | 2026-07-21 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affecte | |
CVE-2026-66920 |
high | 8.2 | 0.0043 | 2026-07-28 | Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and | |
CVE-2026-110830 |
high | 8.2 | 0.0032 | 2026-10-14 | FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a m | |
CVE-2026-110833 |
high | 8.2 | 0.0032 | 2026-10-14 | FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reas |