Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2024-58382 |
high | 8.7 | 0.0049 | 2026-09-09 | league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdo | |
CVE-2026-103604 |
high | 8.7 | 0.0032 | 2026-10-02 | Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString | |
CVE-2026-112894 |
high | 8.7 | 0.0059 | 2026-10-19 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve | |
CVE-2026-114143 |
high | 8.7 | 0.0047 | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slic | |
CVE-2026-116872 |
high | 8.7 | 0.0035 | 2026-10-27 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermP | |
CVE-2026-117540 |
high | 8.7 | 0.0035 | 2026-10-27 | svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanit | |
CVE-2026-118694 |
high | 8.7 | 0.0045 | 2026-10-28 | python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users t | |
CVE-2026-54892 |
high | 8.7 | 0.0089 | 2026-06-23 | Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remo | |
CVE-2026-49851 |
high | 8.7 | 0.0052 | 2026-06-24 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerabl | |
CVE-2026-13311 |
high | 8.7 | 0.0036 | 2026-06-25 | shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a redu | |
CVE-2026-59094 |
high | 8.7 | 0.0079 | 2026-07-02 | Pathway through 0.31.1, fixed in commit d09722e, document store applies a caller-supplied glob patte | |
CVE-2026-58226 |
high | 8.7 | 0.0057 | 2026-07-06 | Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-o | |
CVE-2026-55206 |
high | 8.7 | 0.0027 | 2026-07-08 | py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encr | |
CVE-2026-57480 |
high | 8.7 | 0.0059 | 2026-07-08 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node. | |
CVE-2026-65623 |
high | 8.7 | 0.0048 | 2026-07-24 | Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote den | |
CVE-2026-55968 |
high | 8.7 | 0.0103 | 2026-07-27 | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerabili | |
CVE-2026-55685 |
high | 8.7 | 0.0071 | 2026-07-27 | React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be | |
CVE-2026-73413 |
high | 8.7 | 0.0059 | 2026-08-12 | Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the fl | |
CVE-2026-70453 |
high | 8.7 | 0.0053 | 2026-08-13 | rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function th | |
CVE-2026-54284 |
high | 8.7 | 0.0033 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction an | |
CVE-2026-71491 |
high | 8.7 | 0.0026 | 2026-08-17 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlpars | |
CVE-2026-66046 |
high | 8.7 | 0.0074 | 2026-08-18 | Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic compl | |
CVE-2026-75596 |
high | 8.7 | 0.0037 | 2026-08-19 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2 | |
CVE-2026-114141 |
high | 8.7 | 0.0040 | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's | |
CVE-2026-115347 |
high | 8.7 | 0.0041 | 2026-10-22 | Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text | |
CVE-2026-115352 |
high | 8.7 | 0.0044 | 2026-10-22 | Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that | |
CVE-2026-16762 |
high | 8.7 | 0.0052 | 2026-10-23 | An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause | |
CVE-2026-108529 |
high | 8.7 | 0.0060 | 2026-10-26 | Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allo | |
CVE-2026-113436 |
high | 8.7 | 0.0060 | 2026-10-26 | Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allo | |
CVE-2019-25781 |
high | 8.7 | — | 2026-10-29 | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link p | |
CVE-2026-96640 |
high | 8.2 | 0.0058 | 2026-10-21 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/ | |
CVE-2026-118664 |
high | 8.2 | 0.0032 | 2026-10-28 | decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decod | |
CVE-2026-67216 |
high | 8.2 | 0.0065 | 2026-07-29 | cJSON through 1.7.19 contains an inefficient algorithmic complexity flaw in cJSON_Compare(). When co | |
CVE-2026-68750 |
high | 8.2 | 0.0080 | 2026-08-06 | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex | |
CVE-2026-13149 |
high | 7.7 | 0.0036 | 2026-06-30 | brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exp | |
CVE-2026-111758 |
high | 7.5 | 0.0055 | 2026-10-20 | markdown-it is a Markdown parser. From versions 14.1.0 to before 14.3.3, and 15.0.0 to before 15.0.3 | |
CVE-2026-113729 |
high | 7.5 | 0.0046 | 2026-10-20 | Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCa | |
CVE-2026-114138 |
high | 7.5 | 0.0060 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation | |
CVE-2026-116587 |
high | 7.5 | 0.0037 | 2026-10-26 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards | |
CVE-2026-118035 |
high | 7.5 | 0.0029 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recur | |
CVE-2026-118036 |
high | 7.5 | 0.0037 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recur | |
CVE-2026-116795 |
high | 7.5 | 0.0046 | 2026-10-28 | RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. | |
CVE-2026-84008 |
high | 7.5 | 0.0099 | 2026-10-13 | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne | |
CVE-2026-96958 |
high | 7.5 | 0.0120 | 2026-10-13 | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne | |
CVE-2026-69651 |
high | 7.5 | 0.0125 | 2026-10-13 | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a ne | |
CVE-2026-31932 |
high | 7.5 | 0.0027 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, inefficiency in K | |
CVE-2026-31933 |
high | 7.5 | 0.0035 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted | |
CVE-2026-31934 |
high | 7.5 | 0.0027 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. From version 8.0.0 to before version 8.0.4, there is | |
CVE-2026-31937 |
high | 7.5 | 0.0035 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffe | |
CVE-2026-49293 |
high | 7.5 | 0.0064 | 2026-06-19 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. Versions up to an |