Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-70639 |
medium | 6.8 | 0.0019 | 2026-08-06 | llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-A | |
CVE-2026-111129 |
medium | 6.8 | 0.0013 | 2026-10-15 | Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability i | |
CVE-2026-111144 |
medium | 6.8 | 0.0013 | 2026-10-15 | libansilove 1.3.0 through 1.4.2 contains a NULL pointer dereference vulnerability in ansilove_xbin() | |
CVE-2026-73199 |
medium | 6.5 | 0.0035 | 2026-08-20 | A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a n | |
CVE-2026-70248 |
medium | 6.5 | 0.0043 | 2026-10-13 | Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | |
CVE-2026-83636 |
medium | 6.5 | 0.0043 | 2026-10-13 | Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally. | |
CVE-2026-116658 |
medium | 6.5 | 0.0034 | 2026-10-27 | Tanium addressed a denial of service vulnerability in Enforce. | |
CVE-2026-117548 |
medium | 6.5 | 0.0033 | 2026-10-29 | A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) | |
CVE-2026-50366 |
medium | 6.5 | 0.0114 | 2026-07-14 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s | |
CVE-2026-56168 |
medium | 6.5 | 0.0114 | 2026-07-14 | Null pointer dereference in Windows SMB Server allows an authorized attacker to deny service over a | |
CVE-2026-57976 |
medium | 6.5 | 0.0114 | 2026-07-14 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s | |
CVE-2026-59138 |
medium | 6.5 | 0.0114 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny | |
CVE-2026-61345 |
medium | 6.5 | 0.0114 | 2026-08-11 | Null pointer dereference in Microsoft Remote Registry Service allows an authorized attacker to deny | |
CVE-2026-83648 |
medium | 6.5 | 0.0123 | 2026-10-13 | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s | |
CVE-2026-85859 |
medium | 6.5 | 0.0079 | 2026-10-13 | Null pointer dereference in Windows Message Queuing Queue Manager allows an authorized attacker to d | |
CVE-2026-33903 |
medium | 6.5 | 0.0022 | 2026-03-27 | Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing | |
CVE-2026-33907 |
medium | 6.5 | 0.0025 | 2026-03-27 | Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing | |
CVE-2026-41647 |
medium | 6.5 | 0.0039 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error han | |
CVE-2026-41684 |
medium | 6.5 | 0.0041 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() tr | |
CVE-2026-34350 |
medium | 6.5 | 0.0078 | 2026-05-12 | Null pointer dereference in Windows Storport Miniport Driver allows an unauthorized attacker to deny | |
CVE-2026-9639 |
medium | 6.5 | 0.0055 | 2026-06-26 | Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux a | |
CVE-2026-10593 |
medium | 6.5 | 0.0030 | 2026-06-28 | The Zephyr Bluetooth LE Audio Basic Audio Profile (BAP) unicast client mishandles peer-supplied ASE | |
CVE-2026-18638 |
medium | 6.5 | 0.0041 | 2026-08-11 | Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the | |
CVE-2026-59949 |
medium | 6.5 | 0.0047 | 2026-08-18 | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementation | |
CVE-2026-16846 |
medium | 6.5 | 0.0031 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-68901 |
medium | 6.5 | 0.0053 | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 10.38, the /api/boards/:boardId/export, /api | |
CVE-2026-90484 |
medium | 6.5 | 0.0038 | 2026-10-21 | The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sen | |
CVE-2026-82946 |
medium | 6.5 | 0.0017 | 2026-10-26 | SOEM version 2.0.0 and earlier contains a vulnerability where a malicious device can crash the maste | |
CVE-2026-82389 |
medium | 6.5 | 0.0023 | 2026-10-26 | In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/ | |
CVE-2026-100394 |
medium | 6.5 | 0.0042 | 2026-10-14 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-8723 |
medium | 6.3 | 0.0040 | 2026-05-17 | ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encode | |
CVE-2026-116147 |
medium | 6.3 | 0.0027 | 2026-10-25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a null pointer dereference in the DJVU | |
CVE-2026-28985 |
medium | 6.2 | 0.0016 | 2026-05-11 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS | |
CVE-2026-115921 |
medium | 6.2 | 0.0013 | 2026-10-26 | Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From | |
CVE-2026-39956 |
medium | 6.1 | 0.0017 | 2026-04-13 | jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/bui | |
CVE-2026-13070 |
medium | 6.0 | 0.0013 | 2026-07-22 | A MongoDB server initiating an outbound TLS connection may terminate abnormally when processing a ma | |
CVE-2026-18699 |
medium | 6.0 | 0.0040 | 2026-08-11 | An issue in MongoDB Server's query planner could allow an authenticated user with read-level privile | |
CVE-2026-33262 |
medium | 5.9 | 0.0042 | 2026-04-22 | An attacker can send replies that result in a null pointer dereference, caused by a missing consiste | |
CVE-2026-47143 |
medium | 5.9 | 0.0047 | 2026-07-21 | Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer de | |
CVE-2026-55717 |
medium | 5.9 | 0.0024 | 2026-07-22 | In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together w | |
CVE-2026-118778 |
medium | 5.9 | — | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2026-20221 |
medium | 5.8 | 0.0058 | 2026-10-21 | Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) t | |
CVE-2026-32849 |
medium | 5.7 | 0.0011 | 2026-05-18 | NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op( | |
CVE-2026-48066 |
medium | 5.7 | 0.0012 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, s | |
CVE-2026-71967 |
medium | 5.7 | 0.0017 | 2026-08-10 | OP-TEE OS through 4.10.0, fixed in commit 0aadfc2, contains a null pointer dereference vulnerability | |
CVE-2026-75012 |
medium | 5.7 | 0.0066 | 2026-08-17 | A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. Affected by th | |
CVE-2026-75013 |
medium | 5.7 | 0.0066 | 2026-08-17 | A vulnerability was detected in TOTOLINK EX1200L 9.3.5u.6146_B20201023. This affects the function se | |
CVE-2026-63380 |
medium | 5.7 | 0.0014 | 2026-08-20 | Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid li | |
CVE-2026-69978 |
medium | 5.6 | 0.0039 | 2026-10-13 | Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally. | |
CVE-2023-53658 |
medium | 5.5 | 0.0015 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: spi: bcm-qspi: return error if |