Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-35277 |
high | 8.1 | 0.0027 | 2026-05-28 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected | |
CVE-2026-44019 |
high | 8.1 | 0.0042 | 2026-07-16 | Docling Core defines core data types and transformations for the document processing application Doc | |
CVE-2026-61160 |
high | 8.1 | 0.0042 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-35266 |
high | 7.9 | 0.0011 | 2026-05-28 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected | |
CVE-2026-97811 |
high | 7.8 | 0.0029 | 2026-10-13 | Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | |
CVE-2024-3056 |
high | 7.7 | 0.0053 | 2024-08-02 | A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container | |
CVE-2026-33235 |
high | 7.7 | 0.0037 | 2026-06-24 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia | |
CVE-2026-13149 |
high | 7.7 | 0.0036 | 2026-06-30 | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exp | |
CVE-2026-111805 |
high | 7.7 | 0.0041 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 | |
CVE-2026-62518 |
high | 7.6 | 0.0032 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Int | |
CVE-2025-63561 |
high | 7.5 | 0.0040 | 2025-10-31 | Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris- | |
CVE-2024-27686 |
high | 7.5 | 0.0059 | 2026-05-08 | Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a deni | |
CVE-2024-51316 |
high | 7.5 | 0.0042 | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name fun | |
CVE-2026-16690 |
high | 7.5 | 0.0055 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-16818 |
high | 7.5 | 0.0055 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-17121 |
high | 7.5 | 0.0055 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2025-61480 |
high | 7.5 | 0.0018 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically | |
CVE-2026-94640 |
high | 7.5 | 0.0046 | 2026-09-22 | A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a | |
CVE-2025-52290 |
high | 7.5 | 0.0058 | 2026-10-19 | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-11 | |
CVE-2026-111758 |
high | 7.5 | 0.0055 | 2026-10-20 | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3 | |
CVE-2026-113729 |
high | 7.5 | 0.0046 | 2026-10-20 | Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCa | |
CVE-2026-114138 |
high | 7.5 | 0.0060 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation | |
CVE-2026-77167 |
high | 7.5 | 0.0032 | 2026-10-27 | Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_externa | |
CVE-2026-116656 |
high | 7.5 | 0.0037 | 2026-10-27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | |
CVE-2026-50653 |
high | 7.5 | 0.0117 | 2026-07-14 | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthori | |
CVE-2026-58627 |
high | 7.5 | 0.0117 | 2026-07-14 | Uncontrolled resource consumption in Windows DHCP Server allows an unauthorized attacker to deny ser | |
CVE-2019-5645 |
high | 7.5 | 0.4918 | 2020-09-01 | By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an at | |
CVE-2022-44566 |
high | 7.5 | 0.0126 | 2023-02-09 | A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1 | |
CVE-2023-22792 |
high | 7.5 | 0.0169 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Sp | |
CVE-2023-22795 |
high | 7.5 | 0.0228 | 2023-02-09 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the | |
CVE-2023-22796 |
high | 7.5 | 0.0171 | 2023-02-09 | A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially cr | |
CVE-2023-22799 |
high | 7.5 | 0.0105 | 2023-02-09 | A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a car | |
CVE-2023-27530 |
high | 7.5 | 0.0183 | 2023-03-10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multi | |
CVE-2023-35920 |
high | 7.5 | 0.0087 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All | |
CVE-2023-35921 |
high | 7.5 | 0.0087 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All | |
CVE-2026-27857 |
high | 7.5 | 0.0068 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage | |
CVE-2026-33750 |
high | 7.5 | 0.0045 | 2026-03-27 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior | |
CVE-2026-31935 |
high | 7.5 | 0.0027 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft | |
CVE-2026-34148 |
high | 7.5 | 0.0055 | 2026-04-06 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1 | |
CVE-2025-59440 |
high | 7.5 | 0.0028 | 2026-04-06 | An issue was discovered in USIM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 98 | |
CVE-2026-40303 |
high | 7.5 | 0.0045 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, end | |
CVE-2026-39320 |
high | 7.5 | 0.0043 | 2026-04-21 | Signal K Server is a server application that runs on a central hub in a boat. Versions prior to 2.25 | |
CVE-2026-6780 |
high | 7.5 | 0.0029 | 2026-04-21 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 15 | |
CVE-2026-6781 |
high | 7.5 | 0.0029 | 2026-04-21 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 15 | |
CVE-2026-34290 |
high | 7.5 | 0.0034 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-41135 |
high | 7.5 | 0.0052 | 2026-04-22 | free5GC UDR is the Policy Control Function (PCF) for free5GC, an an open-source project for 5th gene | |
CVE-2026-6022 |
high | 7.5 | 0.0029 | 2026-04-22 | In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resou | |
CVE-2026-33610 |
high | 7.5 | 0.0039 | 2026-04-22 | A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when | |
CVE-2026-41324 |
high | 7.5 | 0.0033 | 2026-04-24 | basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service | |
CVE-2026-42402 |
high | 7.5 | 0.0071 | 2026-05-01 | Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy n |