Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-115905 |
critical | 10.0 | 0.0032 | 2026-10-26 | zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, Zip | |
CVE-2026-57580 |
critical | 9.4 | 0.0059 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Sourc | |
CVE-2026-112362 |
critical | 9.1 | 0.0037 | 2026-10-27 | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 | |
CVE-2026-33807 |
critical | 9.1 | 0.0043 | 2026-04-15 | @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that cau | |
CVE-2026-33808 |
critical | 9.1 | 0.0048 | 2026-04-15 | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express mid | |
CVE-2026-41248 |
critical | 9.1 | 0.0032 | 2026-04-24 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher | |
CVE-2026-112712 |
critical | 9.1 | 0.0031 | 2026-10-20 | @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9 | |
CVE-2026-49473 |
high | 8.8 | 0.0047 | 2026-08-13 | @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Ce | |
CVE-2026-73614 |
high | 8.7 | 0.0068 | 2026-08-13 | Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evalu | |
CVE-2026-73615 |
high | 8.7 | 0.0065 | 2026-08-13 | Network-AI versions before 5.15.1 contain a security matcher bypass vulnerability where SandboxPolic | |
CVE-2026-109428 |
high | 8.7 | 0.0051 | 2026-10-13 | Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attacke | |
CVE-2026-49332 |
high | 8.5 | 0.0053 | 2026-07-28 | A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only | |
CVE-2026-114104 |
high | 8.2 | 0.0033 | 2026-10-21 | adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers t | |
CVE-2026-48788 |
high | 8.2 | 0.0031 | 2026-06-17 | Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can a | |
CVE-2026-8034 |
high | 7.9 | 0.0052 | 2026-05-07 | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server no | |
CVE-2026-42272 |
high | 7.8 | 0.0040 | 2026-05-08 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-42273 |
high | 7.8 | 0.0030 | 2026-05-08 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-42274 |
high | 7.8 | 0.0037 | 2026-05-08 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-44974 |
high | 7.7 | 0.0047 | 2026-07-17 | @hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, Content.disposition() retaine | |
CVE-2026-67201 |
high | 7.7 | 0.0053 | 2026-07-29 | V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulne | |
CVE-2026-42551 |
high | 7.5 | 0.0035 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Request::getMethod() unconditional | |
CVE-2026-56669 |
high | 7.5 | 0.0063 | 2026-07-08 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and | |
CVE-2026-68968 |
high | 7.5 | 0.0042 | 2026-08-12 | Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever | |
CVE-2026-109331 |
high | 7.5 | 0.0014 | 2026-10-12 | Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeH | |
CVE-2026-110682 |
high | 7.5 | 0.0017 | 2026-10-19 | Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value | |
CVE-2026-119190 |
high | 7.4 | — | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2026-109297 |
high | 7.1 | 0.0037 | 2026-10-12 | Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurre | |
CVE-2026-53655 |
medium | 6.9 | 0.0016 | 2026-06-22 | node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended | |
CVE-2026-114656 |
medium | 6.9 | 0.0016 | 2026-10-22 | Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauth | |
CVE-2026-115700 |
medium | 6.9 | 0.0014 | 2026-10-26 | Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request F | |
CVE-2026-30246 |
medium | 6.5 | 0.0025 | 2026-05-05 | Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default | |
CVE-2026-59882 |
medium | 6.5 | 0.0032 | 2026-07-08 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.3, Uri::assertV | |
CVE-2026-114131 |
medium | 6.5 | 0.0036 | 2026-10-21 | Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nux | |
CVE-2026-119200 |
medium | 6.5 | — | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves l | |
CVE-2026-116137 |
medium | 6.3 | 0.0026 | 2026-10-25 | adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade th | |
CVE-2026-114116 |
medium | 6.0 | 0.0026 | 2026-10-21 | Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitl | |
CVE-2026-17084 |
medium | 6.0 | 0.0073 | 2026-08-18 | The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the la | |
CVE-2026-44576 |
medium | 5.4 | 0.0029 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 | |
CVE-2026-116695 |
medium | 5.3 | 0.0035 | 2026-10-27 | Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0 | |
CVE-2026-42177 |
medium | 5.3 | 0.0023 | 2026-05-12 | linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform | |
CVE-2026-53537 |
medium | 5.3 | 0.0029 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header p | |
CVE-2026-18246 |
medium | 4.3 | 0.0032 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict | |
CVE-2026-53538 |
low | 3.7 | 0.0026 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser trea | |
CVE-2026-116264 |
— | — | 0.0018 | 2026-10-28 | MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hid | |
CVE-2026-116265 |
— | — | 0.0018 | 2026-10-28 | MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary wri | |
CVE-2026-116266 |
— | — | 0.0018 | 2026-10-28 | MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary with | |
CVE-2026-116269 |
— | — | 0.0018 | 2026-10-28 | MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated lan | |
CVE-2026-116272 |
— | — | 0.0018 | 2026-10-28 | MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whos | |
CVE-2025-48384 |
— | — | 0.0438 | — | Git contains a link following vulnerability that stems from Git’s inconsistent handling of carriage | KEV |
CVE-2026-63030 |
— | — | 0.1065 | — | WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to per | KEV |