Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-115911 |
medium | 6.5 | 0.0031 | 2026-10-26 | vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authent | |
CVE-2026-115918 |
medium | 6.5 | 0.0035 | 2026-10-26 | vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1 | |
CVE-2026-88858 |
medium | 6.5 | 0.0034 | 2026-10-28 | A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math | |
CVE-2026-49799 |
medium | 6.5 | 0.0114 | 2026-07-14 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allo | |
CVE-2026-65785 |
medium | 6.5 | 0.0058 | 2026-08-11 | Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny ser | |
CVE-2026-67626 |
medium | 6.5 | 0.0088 | 2026-10-13 | Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a | |
CVE-2023-0616 |
medium | 6.5 | 0.0049 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attem | |
CVE-2026-32588 |
medium | 6.5 | 0.0053 | 2026-04-07 | Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise quer | |
CVE-2026-22009 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported | |
CVE-2026-22017 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported | |
CVE-2026-34270 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plug | |
CVE-2026-34271 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plug | |
CVE-2026-34272 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported | |
CVE-2026-34276 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Group Replication Plug | |
CVE-2026-34281 |
medium | 6.5 | 0.0012 | 2026-04-21 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported v | |
CVE-2026-34303 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported | |
CVE-2026-34308 |
medium | 6.5 | 0.0030 | 2026-04-21 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). Supported vers | |
CVE-2026-40924 |
medium | 6.5 | 0.0032 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting | |
CVE-2026-40980 |
medium | 6.5 | 0.0024 | 2026-04-28 | In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amoun | |
CVE-2026-22740 |
medium | 6.5 | 0.0034 | 2026-04-29 | A WebFlux server application that processes multipart requests creates temp files for parts larger t | |
CVE-2026-40016 |
medium | 6.5 | 0.0034 | 2026-05-12 | Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configu | |
CVE-2026-44456 |
medium | 6.5 | 0.0022 | 2026-05-13 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-33378 |
medium | 6.5 | 0.0033 | 2026-05-13 | Using the $__timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL | |
CVE-2026-12319 |
medium | 6.5 | 0.0021 | 2026-06-16 | Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 15 | |
CVE-2026-12325 |
medium | 6.5 | 0.0023 | 2026-06-16 | Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152, | |
CVE-2026-44645 |
medium | 6.5 | 0.0039 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version | |
CVE-2026-57914 |
medium | 6.5 | 0.0044 | 2026-06-26 | By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trig | |
CVE-2026-9002 |
medium | 6.5 | 0.0027 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 could allow an adjacent attacker to cause a deni | |
CVE-2026-49090 |
medium | 6.5 | 0.0042 | 2026-07-01 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Exc | |
CVE-2026-55646 |
medium | 6.5 | 0.0052 | 2026-07-06 | vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/au | |
CVE-2026-55440 |
medium | 6.5 | 0.0072 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t | |
CVE-2026-56145 |
medium | 6.5 | 0.0047 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces | |
CVE-2026-63136 |
medium | 6.5 | 0.0042 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exces | |
CVE-2026-63139 |
medium | 6.5 | 0.0047 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al | |
CVE-2026-10675 |
medium | 6.5 | 0.0039 | 2026-07-21 | In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_rec | |
CVE-2026-60213 |
medium | 6.5 | 0.0033 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60243 |
medium | 6.5 | 0.0042 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60399 |
medium | 6.5 | 0.0042 | 2026-07-21 | Vulnerability in Oracle GoldenGate (component: Receiver Service Executable). Supported versions tha | |
CVE-2026-60403 |
medium | 6.5 | 0.0042 | 2026-07-21 | Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (comp | |
CVE-2026-60404 |
medium | 6.5 | 0.0042 | 2026-07-21 | Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (comp | |
CVE-2026-60411 |
medium | 6.5 | 0.0037 | 2026-07-21 | Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (comp | |
CVE-2026-61194 |
medium | 6.5 | 0.0042 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (compon | |
CVE-2026-61195 |
medium | 6.5 | 0.0042 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (compon | |
CVE-2026-63260 |
medium | 6.5 | 0.0047 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al | |
CVE-2026-63261 |
medium | 6.5 | 0.0047 | 2026-07-21 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Al | |
CVE-2026-63263 |
medium | 6.5 | 0.0047 | 2026-07-22 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Expon | |
CVE-2026-63457 |
medium | 6.5 | 0.0027 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v | |
CVE-2026-19587 |
medium | 6.5 | 0.0036 | 2026-08-12 | Uncontrolled Resource Consumption vulnerability in Samsung Open Source rlottie allows Excessive Allo | |
CVE-2026-68555 |
medium | 6.5 | 0.0053 | 2026-08-19 | Coturn is a free open source implementation of TURN and STUN Server. In 4.15.0, an authenticated TUR | |
CVE-2026-12343 |
medium | 6.5 | 0.0024 | 2026-10-19 | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation |