Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-68981 |
high | 8.8 | 0.0074 | 2026-08-03 | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API usi | |
CVE-2026-112892 |
high | 8.7 | 0.0050 | 2026-10-19 | Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a s | |
CVE-2026-40192 |
high | 8.7 | 0.0067 | 2026-04-15 | Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP- | |
CVE-2026-53430 |
high | 8.7 | 0.0043 | 2026-06-15 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc ( | |
CVE-2026-59803 |
high | 8.7 | 0.0074 | 2026-07-08 | rpcx through 1.9.3, fixed in commit 047aec1, contains a denial-of-service vulnerability in protocol. | |
CVE-2026-55195 |
high | 8.7 | 0.0032 | 2026-07-08 | py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encr | |
CVE-2026-62963 |
high | 8.7 | 0.0052 | 2026-07-16 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidire | |
CVE-2026-48586 |
high | 8.7 | 0.0103 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, | |
CVE-2026-75936 |
high | 8.7 | 0.0061 | 2026-08-18 | Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-jav | |
CVE-2026-93471 |
high | 8.7 | 0.0044 | 2026-10-22 | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml a | |
CVE-2026-109584 |
high | 8.7 | 0.0060 | 2026-10-26 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 impleme | |
CVE-2026-118261 |
high | 8.2 | 0.0037 | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes | |
CVE-2026-43970 |
high | 8.2 | 0.0051 | 2026-05-13 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in ninenines cowlib a | |
CVE-2026-44981 |
high | 8.2 | 0.0051 | 2026-07-16 | CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI rout | |
CVE-2026-97200 |
high | 8.2 | 0.0056 | 2026-10-26 | Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackne | |
CVE-2026-116662 |
high | 7.5 | 0.0037 | 2026-10-27 | Tanium addressed a compression bomb vulnerability in Enforce. | |
CVE-2026-48044 |
high | 7.5 | 0.0049 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.23.0 u | |
CVE-2026-24264 |
high | 7.5 | 0.0072 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improp | |
CVE-2026-44160 |
high | 7.5 | 0.0062 | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS | |
CVE-2026-49855 |
high | 7.5 | 0.0057 | 2026-07-14 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip | |
CVE-2026-41608 |
high | 7.5 | 0.0103 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Pyth | |
CVE-2026-49158 |
high | 7.5 | 0.0103 | 2026-07-27 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby | |
CVE-2026-59932 |
high | 7.5 | 0.0046 | 2026-07-28 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 th | |
CVE-2026-114136 |
high | 7.5 | 0.0044 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse | |
CVE-2026-113873 |
high | 7.5 | 0.0052 | 2026-10-22 | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated atta | |
CVE-2026-118761 |
high | 7.5 | — | 2026-10-29 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. | |
CVE-2026-89059 |
high | 7.5 | 0.0076 | 2026-09-18 | A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodie | |
CVE-2026-96637 |
high | 7.1 | 0.0037 | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek() in src/PIL/SpiderImagePl | |
CVE-2026-116175 |
high | 7.1 | 0.0031 | 2026-10-25 | vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO | |
CVE-2026-44018 |
high | 7.1 | 0.0016 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with th | |
CVE-2026-61455 |
high | 7.1 | 0.0030 | 2026-07-10 | Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks l | |
CVE-2026-61449 |
high | 7.1 | 0.0030 | 2026-07-15 | Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size | |
CVE-2026-109294 |
high | 7.1 | 0.0031 | 2026-10-12 | Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability tha | |
CVE-2026-65627 |
medium | 6.9 | 0.0025 | 2026-10-26 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose ( | |
CVE-2026-59193 |
medium | 6.9 | 0.0060 | 2026-07-10 | Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav | |
CVE-2026-74046 |
medium | 6.9 | 0.0058 | 2026-08-18 | Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() func | |
CVE-2026-115396 |
medium | 6.8 | 0.0012 | 2026-10-22 | Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in The | |
CVE-2026-115503 |
medium | 6.8 | 0.0012 | 2026-10-22 | Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in Extensio | |
CVE-2026-54278 |
medium | 6.6 | 0.0049 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, dur | |
CVE-2026-96636 |
medium | 6.5 | 0.0034 | 2026-10-21 | Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek() and DcxImageFile.seek() rep | |
CVE-2026-40148 |
medium | 6.5 | 0.0024 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the _safe_extractall() function in Praiso | |
CVE-2026-27460 |
medium | 6.5 | 0.0030 | 2026-04-10 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-54233 |
medium | 6.5 | 0.0042 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, vLLM's | |
CVE-2026-93850 |
medium | 6.5 | 0.0038 | 2026-10-26 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail t | |
CVE-2026-54314 |
medium | 6.3 | 0.0055 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompre | |
CVE-2026-92823 |
medium | 6.2 | 0.0016 | 2026-10-21 | A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is d | |
CVE-2026-12588 |
medium | 6.0 | 0.0033 | 2026-07-14 | An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to t | |
CVE-2026-116579 |
medium | 5.9 | 0.0043 | 2026-10-26 | Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. | |
CVE-2024-29370 |
medium | 5.3 | 0.0019 | 2025-12-17 | In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denia | |
CVE-2026-42886 |
medium | 4.9 | 0.0031 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/backups |