Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2655)
CWE-79 (1917)
CWE-416 (1383)
CWE-862 (1244)
CWE-89 (1118)
CWE-22 (1046)
CWE-125 (940)
CWE-200 (865)
CWE-306 (862)
CWE-122 (833)
CWE-20 (815)
CWE-787 (735)
CWE-78 (727)
CWE-918 (707)
CWE-863 (667)
CWE-94 (653)
CWE-74 (604)
CWE-639 (576)
CWE-400 (545)
CWE-269 (508)
CWE-119 (507)
CWE-502 (486)
CWE-287 (453)
CWE-770 (450)
CWE-121 (414)
CWE-190 (383)
CWE-77 (380)
CWE-362 (376)
CWE-476 (310)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-28969 |
high | 7.5 | 0.0053 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18. | |
CVE-2026-43668 |
high | 7.5 | 0.0112 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18. | |
CVE-2026-8521 |
high | 7.5 | 0.0016 | 2026-05-14 | Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to e | |
CVE-2026-8557 |
high | 7.5 | 0.0021 | 2026-05-14 | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker w | |
CVE-2026-12310 |
high | 7.5 | 0.0025 | 2026-06-16 | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR | |
CVE-2026-12314 |
high | 7.5 | 0.0025 | 2026-06-16 | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR | |
CVE-2026-10638 |
high | 7.5 | 0.0035 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed | |
CVE-2026-12445 |
high | 7.5 | 0.0016 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convin | |
CVE-2026-12455 |
high | 7.5 | 0.0023 | 2026-06-17 | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who c | |
CVE-2026-12462 |
high | 7.5 | 0.0027 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had c | |
CVE-2026-13029 |
high | 7.5 | 0.0025 | 2026-06-24 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker wh | |
CVE-2026-13283 |
high | 7.5 | 0.0034 | 2026-06-25 | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote atta | |
CVE-2026-57585 |
high | 7.5 | 0.0049 | 2026-06-30 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out | |
CVE-2026-13802 |
high | 7.5 | 0.0036 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin | |
CVE-2026-13807 |
high | 7.5 | 0.0031 | 2026-06-30 | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker wh | |
CVE-2026-13814 |
high | 7.5 | 0.0030 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin | |
CVE-2026-13831 |
high | 7.5 | 0.0034 | 2026-06-30 | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-13855 |
high | 7.5 | 0.0034 | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w | |
CVE-2026-14064 |
high | 7.5 | 0.0036 | 2026-06-30 | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attac | |
CVE-2026-24266 |
high | 7.5 | 0.0067 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use- | |
CVE-2026-14426 |
high | 7.5 | 0.0036 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced | |
CVE-2026-15111 |
high | 7.5 | 0.0030 | 2026-07-08 | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convi | |
CVE-2026-15117 |
high | 7.5 | 0.0030 | 2026-07-08 | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who co | |
CVE-2026-15764 |
high | 7.5 | 0.0030 | 2026-07-14 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker | |
CVE-2026-15765 |
high | 7.5 | 0.0030 | 2026-07-14 | Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convi | |
CVE-2026-15777 |
high | 7.5 | 0.0030 | 2026-07-14 | Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who | |
CVE-2026-17887 |
high | 7.5 | 0.0030 | 2026-07-30 | Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who con | |
CVE-2026-17896 |
high | 7.5 | 0.0036 | 2026-07-30 | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to exec | |
CVE-2026-17898 |
high | 7.5 | 0.0027 | 2026-07-30 | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced | |
CVE-2026-56848 |
high | 7.5 | 0.0052 | 2026-08-04 | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly whil | |
CVE-2026-19142 |
high | 7.5 | 0.0030 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convi | |
CVE-2026-19158 |
high | 7.5 | 0.0030 | 2026-08-06 | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacke | |
CVE-2026-19159 |
high | 7.5 | 0.0030 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convi | |
CVE-2026-19165 |
high | 7.5 | 0.0027 | 2026-08-06 | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convin | |
CVE-2026-19176 |
high | 7.5 | 0.0053 | 2026-08-06 | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had co | |
CVE-2026-18706 |
high | 7.5 | 0.0047 | 2026-08-11 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able t | |
CVE-2026-19558 |
high | 7.5 | 0.0027 | 2026-08-11 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convin | |
CVE-2026-56684 |
high | 7.5 | 0.0052 | 2026-08-18 | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey | |
CVE-2026-19666 |
high | 7.5 | 0.0057 | 2026-09-16 | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is | |
CVE-2026-112396 |
high | 7.5 | 0.0069 | 2026-10-19 | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when | |
CVE-2026-97206 |
high | 7.5 | 0.0033 | 2026-10-21 | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifeti | 1 PoC |
CVE-2026-74758 |
high | 7.5 | 0.0024 | 2026-10-21 | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a rem | |
CVE-2026-54127 |
high | 7.4 | 0.0031 | 2026-07-14 | Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. | |
CVE-2026-32156 |
high | 7.4 | 0.0029 | 2026-04-14 | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker | |
CVE-2026-10646 |
high | 7.4 | 0.0045 | 2026-06-28 | Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a po | |
CVE-2026-16851 |
high | 7.4 | 0.0031 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-60080 |
high | 7.3 | 0.0068 | 2026-07-21 | Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Ap | |
CVE-2026-71226 |
high | 7.3 | 0.0014 | 2026-08-05 | Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an e | |
CVE-2026-63035 |
high | 7.2 | 0.0076 | 2026-07-30 | A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an | |
CVE-2026-57187 |
high | 7.1 | 0.0048 | 2026-10-26 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, |