Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-69836 |
critical | 10.0 | 0.0153 | 2026-08-20 | Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c | 2 PoC |
CVE-2025-11367 |
critical | 10.0 | 0.0063 | 2025-11-12 | The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization | |
CVE-2026-45829 |
critical | 10.0 | 0.1515 | 2026-05-18 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python | |
CVE-2026-60366 |
critical | 10.0 | 0.0055 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-11756 |
critical | 10.0 | 0.0081 | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE pla | |
CVE-2026-65883 |
critical | 10.0 | 0.0081 | 2026-07-29 | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guar | |
CVE-2026-17061 |
critical | 10.0 | 0.0081 | 2026-08-11 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 20 | |
CVE-2026-50517 |
critical | 9.9 | 0.0169 | 2026-07-24 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over | |
CVE-2026-50515 |
critical | 9.9 | 0.0169 | 2026-08-06 | Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code | |
CVE-2026-46386 |
critical | 9.9 | 0.0049 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproje | |
CVE-2026-8476 |
critical | 9.9 | 0.0097 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the | |
CVE-2026-60369 |
critical | 9.9 | 0.0047 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-115806 |
critical | 9.8 | 0.0055 | 2026-10-24 | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in | |
CVE-2026-110879 |
critical | 9.8 | 0.0120 | 2026-10-28 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected cla | |
CVE-2026-115968 |
critical | 9.8 | — | 2026-10-28 | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member a | |
CVE-2026-50522 |
critical | 9.8 | 0.0304 | 2026-07-14 | Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an | KEV |
CVE-2026-54117 |
critical | 9.8 | 0.0153 | 2026-07-14 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over | |
CVE-2026-54118 |
critical | 9.8 | 0.0153 | 2026-07-14 | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over | |
CVE-2026-55944 |
critical | 9.8 | 0.0153 | 2026-07-14 | Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execu | 1 PoC |
CVE-2026-58644 |
critical | 9.8 | 0.1587 | 2026-07-14 | Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unaut | KEV |
CVE-2026-59124 |
critical | 9.8 | 0.0153 | 2026-08-11 | Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unaut | |
CVE-2026-88131 |
critical | 9.8 | 0.0123 | 2026-10-08 | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute | |
CVE-2025-62025 |
critical | 9.8 | 0.0058 | 2025-10-22 | Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects | |
CVE-2026-6023 |
critical | 9.8 | 0.0054 | 2026-04-22 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is | |
CVE-2026-33819 |
critical | 9.8 | 0.0084 | 2026-04-23 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code | |
CVE-2026-41635 |
critical | 9.8 | 0.0062 | 2026-04-27 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes | |
CVE-2026-41409 |
critical | 9.8 | 0.0043 | 2026-04-27 | The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname | |
CVE-2026-42778 |
critical | 9.8 | 0.0066 | 2026-05-01 | The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original is | |
CVE-2026-42779 |
critical | 9.8 | 0.0123 | 2026-05-01 | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original is | |
CVE-2026-27053 |
critical | 9.8 | 0.0039 | 2026-06-15 | Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | |
CVE-2026-49085 |
critical | 9.8 | 0.0048 | 2026-06-15 | Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formida | |
CVE-2026-49104 |
critical | 9.8 | 0.0048 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForm | |
CVE-2026-49105 |
critical | 9.8 | 0.0048 | 2026-06-15 | Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidabl | |
CVE-2026-49106 |
critical | 9.8 | 0.0038 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 | |
CVE-2026-49109 |
critical | 9.8 | 0.0038 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elem | |
CVE-2026-49763 |
critical | 9.8 | 0.0038 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions. | |
CVE-2026-49765 |
critical | 9.8 | 0.0038 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Eleme | |
CVE-2026-49769 |
critical | 9.8 | 0.0031 | 2026-06-15 | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-49781 |
critical | 9.8 | 0.0050 | 2026-06-15 | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. | |
CVE-2026-9691 |
critical | 9.8 | 0.0048 | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, | |
CVE-2026-35300 |
critical | 9.8 | 0.0056 | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Support | |
CVE-2026-27429 |
critical | 9.8 | 0.0056 | 2026-06-17 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
CVE-2026-39529 |
critical | 9.8 | 0.0037 | 2026-06-17 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |
CVE-2026-40725 |
critical | 9.8 | 0.0037 | 2026-06-17 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | |
CVE-2026-42380 |
critical | 9.8 | 0.0051 | 2026-06-17 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | |
CVE-2026-49075 |
critical | 9.8 | 0.0037 | 2026-06-17 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | |
CVE-2026-49107 |
critical | 9.8 | 0.0037 | 2026-06-17 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |
CVE-2026-52706 |
critical | 9.8 | 0.0047 | 2026-06-17 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |
CVE-2026-54194 |
critical | 9.8 | 0.0037 | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-54806 |
critical | 9.8 | 0.0070 | 2026-06-17 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. |