Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2660)
CWE-79 (1926)
CWE-416 (1558)
CWE-862 (1259)
CWE-122 (1130)
CWE-89 (1122)
CWE-125 (1089)
CWE-22 (1051)
CWE-200 (871)
CWE-306 (870)
CWE-20 (831)
CWE-787 (739)
CWE-78 (728)
CWE-918 (712)
CWE-863 (669)
CWE-94 (656)
CWE-74 (605)
CWE-639 (580)
CWE-400 (546)
CWE-269 (511)
CWE-119 (507)
CWE-502 (493)
CWE-287 (455)
CWE-770 (453)
CWE-121 (446)
CWE-190 (419)
CWE-362 (394)
CWE-77 (384)
CWE-476 (322)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-28969 |
high | 7.5 | 0.0053 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18. | |
CVE-2026-43668 |
high | 7.5 | 0.0112 | 2026-05-11 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18. | |
CVE-2026-8521 |
high | 7.5 | 0.0016 | 2026-05-14 | Use after free in Tab Groups in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to e | |
CVE-2026-8557 |
high | 7.5 | 0.0021 | 2026-05-14 | Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker w | |
CVE-2026-12310 |
high | 7.5 | 0.0025 | 2026-06-16 | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR | |
CVE-2026-12314 |
high | 7.5 | 0.0025 | 2026-06-16 | Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR | |
CVE-2026-10638 |
high | 7.5 | 0.0035 | 2026-06-16 | subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed | |
CVE-2026-12445 |
high | 7.5 | 0.0016 | 2026-06-17 | Use after free in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convin | |
CVE-2026-12455 |
high | 7.5 | 0.0023 | 2026-06-17 | Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who c | |
CVE-2026-12462 |
high | 7.5 | 0.0027 | 2026-06-17 | Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had c | |
CVE-2026-13029 |
high | 7.5 | 0.0025 | 2026-06-24 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker wh | |
CVE-2026-13283 |
high | 7.5 | 0.0034 | 2026-06-25 | Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote atta | |
CVE-2026-57585 |
high | 7.5 | 0.0049 | 2026-06-30 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out | |
CVE-2026-13802 |
high | 7.5 | 0.0036 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin | |
CVE-2026-13807 |
high | 7.5 | 0.0031 | 2026-06-30 | Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker wh | |
CVE-2026-13814 |
high | 7.5 | 0.0030 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin | |
CVE-2026-13831 |
high | 7.5 | 0.0034 | 2026-06-30 | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-13855 |
high | 7.5 | 0.0034 | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w | |
CVE-2026-14064 |
high | 7.5 | 0.0036 | 2026-06-30 | Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attac | |
CVE-2026-24266 |
high | 7.5 | 0.0067 | 2026-07-01 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a use- | |
CVE-2026-14426 |
high | 7.5 | 0.0036 | 2026-07-01 | Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced | |
CVE-2026-15111 |
high | 7.5 | 0.0030 | 2026-07-08 | Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convi | |
CVE-2026-15117 |
high | 7.5 | 0.0030 | 2026-07-08 | Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who co | |
CVE-2026-15764 |
high | 7.5 | 0.0030 | 2026-07-14 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker | |
CVE-2026-15765 |
high | 7.5 | 0.0030 | 2026-07-14 | Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convi | |
CVE-2026-15777 |
high | 7.5 | 0.0030 | 2026-07-14 | Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who | |
CVE-2026-17887 |
high | 7.5 | 0.0030 | 2026-07-30 | Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who con | |
CVE-2026-17896 |
high | 7.5 | 0.0036 | 2026-07-30 | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to exec | |
CVE-2026-17898 |
high | 7.5 | 0.0027 | 2026-07-30 | Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced | |
CVE-2026-56848 |
high | 7.5 | 0.0052 | 2026-08-04 | A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly whil | |
CVE-2026-19142 |
high | 7.5 | 0.0030 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convi | |
CVE-2026-19158 |
high | 7.5 | 0.0030 | 2026-08-06 | Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacke | |
CVE-2026-19159 |
high | 7.5 | 0.0030 | 2026-08-06 | Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convi | |
CVE-2026-19165 |
high | 7.5 | 0.0027 | 2026-08-06 | Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convin | |
CVE-2026-19176 |
high | 7.5 | 0.0053 | 2026-08-06 | Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had co | |
CVE-2026-18706 |
high | 7.5 | 0.0047 | 2026-08-11 | An issue in MongoDB Server's $graphLookup aggregation stage could allow an authenticated user able t | |
CVE-2026-19558 |
high | 7.5 | 0.0027 | 2026-08-11 | Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convin | |
CVE-2026-56684 |
high | 7.5 | 0.0052 | 2026-08-18 | Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey | |
CVE-2026-19666 |
high | 7.5 | 0.0057 | 2026-09-16 | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is | |
CVE-2026-112396 |
high | 7.5 | 0.0069 | 2026-10-19 | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when | |
CVE-2026-97206 |
high | 7.5 | 0.0033 | 2026-10-21 | NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifeti | 1 PoC |
CVE-2026-74758 |
high | 7.5 | 0.0024 | 2026-10-21 | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a rem | |
CVE-2026-69397 |
high | 7.5 | 0.0061 | 2026-09-08 | Use after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network | |
CVE-2026-69599 |
high | 7.5 | 0.0066 | 2026-09-08 | Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over | |
CVE-2026-69607 |
high | 7.5 | 0.0061 | 2026-09-08 | Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a | |
CVE-2026-70570 |
high | 7.5 | 0.0069 | 2026-09-08 | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an | |
CVE-2026-72928 |
high | 7.5 | 0.0066 | 2026-09-08 | Use after free in Windows DNS allows an authorized attacker to execute code over a network. | |
CVE-2026-72954 |
high | 7.5 | 0.0066 | 2026-09-08 | Use after free in Windows Deployment Services allows an authorized attacker to execute code over a n | |
CVE-2026-78446 |
high | 7.5 | 0.0048 | 2026-09-08 | Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute cod | |
CVE-2026-62813 |
high | 7.5 | 0.0066 | 2026-09-08 | Use after free in Active Directory Domain Services allows an authorized attacker to execute code ove |