Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-13772 |
critical | 9.9 | 0.0051 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacke | |
CVE-2026-115931 |
critical | 9.9 | 0.0049 | 2026-10-23 | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. T | |
CVE-2026-116692 |
critical | 9.8 | 0.0070 | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-40008 |
critical | 9.8 | 0.0060 | 2026-07-10 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in | |
CVE-2026-44416 |
critical | 9.8 | 0.0124 | 2026-08-10 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apach | |
CVE-2026-8178 |
critical | 9.2 | 0.0060 | 2026-05-08 | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, th | |
CVE-2026-119050 |
critical | 9.2 | — | 2026-10-29 | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers | |
CVE-2026-14380 |
high | 8.8 | 0.0050 | 2026-07-07 | DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. | |
CVE-2026-44174 |
high | 8.7 | 0.0049 | 2026-07-16 | Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate | |
CVE-2026-65608 |
high | 8.7 | 0.0112 | 2026-07-23 | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory | |
CVE-2026-44339 |
high | 8.6 | 0.0036 | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.37 and praisonaiagents versi | |
CVE-2026-55543 |
high | 8.5 | 0.0021 | 2026-10-16 | TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set g | |
CVE-2026-58659 |
high | 8.4 | 0.0063 | 2026-07-15 | PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerabi | |
CVE-2026-41175 |
high | 8.1 | 0.0030 | 2026-04-22 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and | |
CVE-2026-13181 |
high | 8.1 | 0.0073 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUp | |
CVE-2026-13187 |
high | 8.1 | 0.0034 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tam | |
CVE-2026-24246 |
high | 7.8 | 0.0043 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper con | |
CVE-2026-111851 |
high | 7.6 | 0.0027 | 2026-10-22 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in | |
CVE-2026-61536 |
high | 7.5 | 0.0038 | 2026-07-30 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, | |
CVE-2026-63337 |
high | 7.5 | 0.0056 | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w | |
CVE-2026-49287 |
high | 7.4 | 0.0046 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, | |
CVE-2026-55153 |
high | 7.1 | 0.0019 | 2026-07-01 | mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c | |
CVE-2026-114660 |
high | 7.0 | 0.0021 | 2026-10-22 | Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dyn | |
CVE-2023-37207 |
medium | 6.5 | 0.0074 | 2023-07-05 | A website could have obscured the fullscreen notification by using a URL with a scheme handled by an | |
CVE-2026-64663 |
medium | 6.5 | 0.0040 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, m | |
CVE-2026-114508 |
medium | 6.5 | 0.0041 | 2026-10-21 | Laravel is a web application framework. From 12.45.0 until 12.68.0 and 13.27.0, crafted relationship | |
CVE-2026-115886 |
medium | 6.5 | 0.0068 | 2026-10-23 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-53666 |
medium | 6.1 | 0.0042 | 2026-07-27 | React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was writte | |
CVE-2026-63317 |
medium | 5.6 | 0.0085 | 2026-07-24 | Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP | |
CVE-2026-112145 |
medium | 5.5 | 0.0043 | 2026-10-19 | A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerabil | |
CVE-2026-48817 |
medium | 5.3 | 0.0021 | 2026-06-17 | Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a r | |
CVE-2026-115749 |
medium | 4.8 | 0.0022 | 2026-10-23 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary modu | |
CVE-2026-57284 |
medium | 4.3 | 0.0034 | 2026-06-24 | Jenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can | |
CVE-2021-21985 |
— | — | 1.0000 | — | VMware vSphere Client contains an improper input validation vulnerability in the Virtual SAN Health | KEV |
CVE-2026-42027 |
— | — | 0.0071 | 2026-05-04 | Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Aff | |
CVE-2026-82078 |
— | — | 0.6089 | — | PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate sys | KEV |