Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-53539 |
high | 7.5 | 0.0046 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing applicati | |
CVE-2026-59868 |
high | 7.5 | 0.0064 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled | |
CVE-2026-59869 |
high | 7.5 | 0.0059 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0 | |
CVE-2026-59870 |
high | 7.5 | 0.0074 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA sup | |
CVE-2026-59887 |
high | 7.5 | 0.0064 | 2026-07-08 | linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: sch | |
CVE-2026-59922 |
high | 7.5 | 0.0064 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tild | |
CVE-2026-59925 |
high | 7.5 | 0.0064 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of we | |
CVE-2026-59928 |
high | 7.5 | 0.0065 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document | |
CVE-2026-56669 |
high | 7.5 | 0.0063 | 2026-07-08 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and | |
CVE-2026-71488 |
high | 7.5 | 0.0063 | 2026-08-06 | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2 | |
CVE-2026-73643 |
high | 7.5 | 0.0049 | 2026-08-13 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML documen | |
CVE-2026-49329 |
high | 7.5 | 0.0070 | 2026-09-01 | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauth | |
CVE-2026-19630 |
high | 7.5 | 0.0045 | 2026-10-21 | In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additio | |
CVE-2026-75507 |
high | 7.5 | 0.0060 | 2026-10-22 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 an | |
CVE-2026-110688 |
high | 7.5 | 0.0017 | 2026-10-19 | Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the | |
CVE-2026-119197 |
high | 7.5 | — | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large ma | |
CVE-2026-119195 |
high | 7.5 | — | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-leng | |
CVE-2026-119196 |
high | 7.5 | — | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeat | |
CVE-2026-119194 |
high | 7.5 | — | 2026-10-29 | pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding | |
CVE-2026-96643 |
high | 7.1 | 0.0037 | 2026-10-21 | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeat | |
CVE-2026-13064 |
high | 7.1 | 0.0045 | 2026-07-22 | Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate | |
CVE-2026-115585 |
high | 7.1 | 0.0041 | 2026-10-23 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.2, an incomplete remediation | |
CVE-2026-112401 |
medium | 6.9 | 0.0065 | 2026-10-19 | Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while | |
CVE-2026-112891 |
medium | 6.9 | 0.0055 | 2026-10-19 | Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when | |
CVE-2026-65631 |
medium | 6.9 | 0.0024 | 2026-10-26 | Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause | |
CVE-2026-40476 |
medium | 6.9 | 0.0064 | 2026-04-17 | graphql-go is a Go implementation of GraphQL. In versions 15.31.4 and below, the OverlappingFieldsCa | |
CVE-2026-44378 |
medium | 6.9 | 0.0032 | 2026-05-27 | Botan is a C++ cryptography library. Prior to 3.12.0, certain patterns of indefinite length encoding | |
CVE-2026-89314 |
medium | 6.9 | 0.0025 | 2026-10-23 | `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, makin | |
CVE-2026-110270 |
medium | 6.8 | 0.0017 | 2026-10-14 | OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons | |
CVE-2026-45822 |
medium | 6.6 | 0.0051 | 2026-06-30 | decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits | |
CVE-2026-33033 |
medium | 6.5 | 0.0088 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartPar | |
CVE-2026-35599 |
medium | 6.5 | 0.0035 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatInterva | |
CVE-2026-72663 |
medium | 6.5 | 0.0047 | 2026-08-13 | Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data | |
CVE-2026-64644 |
medium | 6.3 | 0.0067 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15 | |
CVE-2026-114129 |
medium | 6.2 | 0.0025 | 2026-10-21 | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal mem | |
CVE-2026-113789 |
medium | 6.0 | 0.0039 | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PD | |
CVE-2026-70196 |
medium | 5.9 | 0.0091 | 2026-10-13 | Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service o | |
CVE-2024-12133 |
medium | 5.3 | 0.0111 | 2025-02-10 | A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large | |
CVE-2024-12243 |
medium | 5.3 | 0.0129 | 2025-02-10 | A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficien | |
CVE-2026-53550 |
medium | 5.3 | 0.0042 | 2026-06-22 | js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document c | |
CVE-2026-71848 |
medium | 5.3 | 0.0051 | 2026-08-07 | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.0 to | |
CVE-2026-19668 |
medium | 5.3 | 0.0048 | 2026-09-16 | A BIND recursive resolver may experience excessive resource consumption if it encounters large numbe | |
CVE-2026-116577 |
medium | 5.3 | 0.0038 | 2026-10-26 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP | |
CVE-2026-49460 |
medium | 5.1 | 0.0017 | 2026-06-22 | pypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this | |
CVE-2026-6042 |
medium | 4.8 | 0.0024 | 2026-04-10 | A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the | |
CVE-2026-111766 |
low | 3.7 | 0.0043 | 2026-10-19 | markdown-it is a Markdown parser. Prior to 14.3.3 and 15.0.3, when the html option or commonmark pre | |
CVE-2026-6879 |
low | 2.0 | 0.0036 | 2026-07-28 | `Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when us | |
CVE-2026-115319 |
low | 2.0 | 0.0010 | 2026-10-22 | fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskAction | |
CVE-2026-116133 |
— | — | 0.0031 | 2026-10-28 | HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multi | |
CVE-2026-116267 |
— | — | 0.0018 | 2026-10-28 | MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages from |