Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (837)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42933 |
critical | 10.0 | 0.0051 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerabilit | |
CVE-2026-69399 |
critical | 10.0 | 0.0048 | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability | |
CVE-2026-72526 |
critical | 9.9 | 0.0070 | 2026-08-12 | A flaw was found in the multicloud-integrations component. The Application propagation controller pr | |
CVE-2026-67567 |
critical | 9.9 | 0.0062 | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a ten | |
CVE-2026-114612 |
critical | 9.9 | 0.0032 | 2026-10-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 un | |
CVE-2026-70398 |
critical | 9.6 | 0.0052 | 2026-08-12 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHA | |
CVE-2026-23751 |
critical | 9.3 | 0.0088 | 2026-04-23 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) | |
CVE-2026-15183 |
critical | 9.2 | 0.0031 | 2026-07-14 | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) version | |
CVE-2026-7381 |
critical | 9.1 | 0.0044 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewri | |
CVE-2026-44945 |
critical | 9.1 | 0.0056 | 2026-08-05 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests | |
CVE-2026-73079 |
high | 8.5 | 0.0039 | 2026-08-11 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product s | |
CVE-2026-118687 |
high | 8.3 | 0.0019 | 2026-10-28 | Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 | |
CVE-2026-56675 |
high | 8.3 | 0.0050 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted a | |
CVE-2026-43910 |
high | 8.2 | 0.0043 | 2026-07-28 | Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C Web | |
CVE-2026-83837 |
high | 7.8 | 0.0032 | 2026-10-13 | Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate priv | |
CVE-2026-46592 |
high | 7.5 | 0.0063 | 2026-07-06 | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa | |
CVE-2026-13062 |
high | 7.1 | 0.0019 | 2026-07-22 | An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able | |
CVE-2026-70148 |
medium | 6.5 | 0.0040 | 2026-10-13 | Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclo | |
CVE-2026-49086 |
medium | 6.5 | 0.0068 | 2026-07-06 | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa | |
CVE-2026-44964 |
medium | 6.5 | 0.0034 | 2026-08-07 | In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is de | |
CVE-2026-73424 |
medium | 6.5 | 0.0038 | 2026-08-17 | Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel ada | |
CVE-2026-106462 |
medium | 6.4 | 0.0017 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-co | |
CVE-2026-63643 |
medium | 6.3 | 0.0066 | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR hand | |
CVE-2026-54663 |
medium | 6.1 | 0.0022 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-12879 |
medium | 5.9 | 0.0030 | 2026-07-09 | An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to | |
CVE-2026-114478 |
medium | 5.9 | 0.0026 | 2026-10-21 | Insufficient preservation of the original sender in the forwarding of Progressive Robot hMailServer | |
CVE-2026-6993 |
medium | 5.5 | 0.0032 | 2026-04-25 | A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewSe | |
CVE-2026-101897 |
medium | 5.1 | 0.0035 | 2026-10-14 | Angular is a development platform for building mobile and desktop web applications using TypeScript/ | |
CVE-2026-106487 |
medium | 5.0 | 0.0026 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plug | |
CVE-2026-39961 |
medium | 4.9 | 0.0040 | 2026-04-09 | Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From | |
CVE-2026-67077 |
medium | 4.2 | 0.0012 | 2026-10-28 | HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an atta | |
CVE-2026-48522 |
medium | 4.2 | 0.0022 | 2026-05-28 | PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argu | |
CVE-2026-47122 |
medium | 4.2 | 0.0010 | 2026-07-21 | Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate | |
CVE-2026-83548 |
— | — | 0.0804 | — | SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a | KEV |
CVE-2026-84616 |
— | — | 0.0015 | 2026-09-14 | A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 |