Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-72587 |
medium | 6.1 | 0.0032 | 2026-08-10 | A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remot | |
CVE-2026-62899 |
medium | 5.9 | 0.0075 | 2026-08-11 | Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an u | |
CVE-2026-115877 |
medium | 5.4 | 0.0026 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.1 | |
CVE-2026-1491 |
medium | 5.3 | 0.0039 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-2862 |
medium | 5.3 | 0.0039 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-2708 |
medium | 5.3 | 0.0032 | 2026-04-23 | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_ | |
CVE-2026-40561 |
medium | 5.3 | 0.0036 | 2026-05-03 | Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence. | |
CVE-2026-64785 |
medium | 5.3 | 0.0029 | 2026-07-23 | SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other | |
CVE-2026-71554 |
medium | 5.3 | 0.0042 | 2026-08-06 | h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 ac | |
CVE-2026-6338 |
medium | 4.9 | 0.0029 | 2026-06-11 | A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3. | |
CVE-2026-10841 |
medium | 4.8 | 0.0024 | 2026-09-18 | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0. | |
CVE-2026-11548 |
medium | 4.8 | 0.0025 | 2026-09-18 | IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17. | |
CVE-2026-11722 |
medium | 4.8 | 0.0025 | 2026-09-18 | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0. | |
CVE-2026-53538 |
low | 3.7 | 0.0026 | 2026-06-22 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser trea | |
CVE-2026-58044 |
low | 3.7 | 0.0027 | 2026-08-04 | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding pro | |
CVE-2026-103995 |
low | 2.0 | 0.0036 | 2026-10-27 | Response body and chunk parsing would handle non-hex or negative integers incorrectly which could re | |
CVE-2023-41265 |
— | — | 0.8821 | — | Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges a | KEV |
CVE-2025-61884 |
— | — | 0.9589 | — | Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime c | KEV |
CVE-2026-48710 |
— | — | 0.7029 | — | Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers | KEV |
CVE-2026-48746 |
— | — | 0.0115 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a | |
CVE-2026-52845 |
— | — | 0.0044 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_ | |
CVE-2026-86146 |
— | — | 0.0020 | 2026-10-21 | Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1 | |
CVE-2026-115823 |
— | — | 0.0019 | 2026-10-25 | Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing resp |