Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42403 |
high | 7.5 | 0.0076 | 2026-05-01 | Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy d | |
CVE-2026-23870 |
high | 7.5 | 0.0153 | 2026-05-06 | A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to s | |
CVE-2026-28872 |
high | 7.5 | 0.0046 | 2026-05-11 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS | |
CVE-2026-28908 |
high | 7.5 | 0.0048 | 2026-05-11 | A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in macO | |
CVE-2026-23824 |
high | 7.5 | 0.0033 | 2026-05-12 | Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An una | |
CVE-2026-34648 |
high | 7.5 | 0.2138 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34649 |
high | 7.5 | 0.1361 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34650 |
high | 7.5 | 0.1508 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34651 |
high | 7.5 | 0.0067 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34665 |
high | 7.5 | 0.0079 | 2026-05-12 | CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontr | |
CVE-2026-44240 |
high | 7.5 | 0.0051 | 2026-05-12 | basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denia | |
CVE-2026-42544 |
high | 7.5 | 0.0039 | 2026-05-12 | Granian is a Rust HTTP server for Python applications. From 1.2.0 to 2.7.4, Granian aborts a worker | |
CVE-2026-44241 |
high | 7.5 | 0.0064 | 2026-05-12 | Micronaut Framework is a JVM-based full stack Java framework designed for building modular, easily t | |
CVE-2026-42583 |
high | 7.5 | 0.0046 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-44248 |
high | 7.5 | 0.0056 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-7528 |
high | 7.5 | 0.0028 | 2026-05-27 | IBM Langflow OSS 1.0.0 through 1.9.0 could allow a denial of service due to uncontrolled resource co | |
CVE-2026-45047 |
high | 7.5 | 0.0044 | 2026-05-27 | bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTe | |
CVE-2026-5497 |
high | 7.5 | 0.0054 | 2026-06-11 | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attac | |
CVE-2026-50645 |
high | 7.5 | 0.0046 | 2026-06-12 | There is no restriction on the amount of attachment headers that a message can contain when being de | |
CVE-2026-41708 |
high | 7.5 | 0.0028 | 2026-06-15 | In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause | |
CVE-2026-46862 |
high | 7.5 | 0.0046 | 2026-06-17 | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported v | |
CVE-2026-50196 |
high | 7.5 | 0.0045 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cl | |
CVE-2026-45357 |
high | 7.5 | 0.0039 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version | |
CVE-2026-48937 |
high | 7.5 | 0.0057 | 2026-06-18 | A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `G | |
CVE-2026-49293 |
high | 7.5 | 0.0064 | 2026-06-19 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to an | |
CVE-2026-53539 |
high | 7.5 | 0.0046 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing applicati | |
CVE-2026-55446 |
high | 7.5 | 0.0058 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an a | |
CVE-2026-48619 |
high | 7.5 | 0.0064 | 2026-06-26 | A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which | |
CVE-2026-36478 |
high | 7.5 | 0.0055 | 2026-06-26 | An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of se | |
CVE-2026-56018 |
high | 7.5 | 0.0061 | 2026-06-29 | JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowi | |
CVE-2026-57080 |
high | 7.5 | 0.0049 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer- | |
CVE-2026-57081 |
high | 7.5 | 0.0049 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested ben | |
CVE-2026-52197 |
high | 7.5 | 0.0049 | 2026-06-30 | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of se | |
CVE-2026-54399 |
high | 7.5 | 0.0078 | 2026-07-01 | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpCompone | |
CVE-2026-54428 |
high | 7.5 | 0.0087 | 2026-07-01 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpCompo | |
CVE-2026-54712 |
high | 7.5 | 0.0046 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation l | |
CVE-2026-9563 |
high | 7.5 | 0.0035 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not e | |
CVE-2026-52192 |
high | 7.5 | 0.0058 | 2026-07-02 | An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of se | |
CVE-2026-26307 |
high | 7.5 | 0.0063 | 2026-07-03 | Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searc | |
CVE-2026-24012 |
high | 7.5 | 0.0074 | 2026-07-06 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB. Some interface fails to impose re | |
CVE-2026-58210 |
high | 7.5 | 0.0074 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr | |
CVE-2026-40007 |
high | 7.5 | 0.0049 | 2026-07-10 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_a | |
CVE-2026-33382 |
high | 7.5 | 0.0039 | 2026-07-10 | Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request bo | |
CVE-2026-8609 |
high | 7.5 | 0.0040 | 2026-07-10 | An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, caus | |
CVE-2026-12523 |
high | 7.5 | 0.0053 | 2026-07-14 | Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion ( | |
CVE-2026-59200 |
high | 7.5 | 0.0039 | 2026-07-14 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/Pdf | |
CVE-2026-47476 |
high | 7.5 | 0.0054 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncont | |
CVE-2026-47479 |
high | 7.5 | 0.0049 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncont | |
CVE-2026-49476 |
high | 7.5 | 0.0064 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the | |
CVE-2026-49477 |
high | 7.5 | 0.0064 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the |