Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-49108 |
critical | 9.8 | 0.0030 | 2026-06-17 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. | |
CVE-2026-53914 |
critical | 9.8 | 0.0033 | 2026-06-26 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the buil | |
CVE-2026-56032 |
critical | 9.8 | 0.0056 | 2026-06-26 | Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | |
CVE-2026-56057 |
critical | 9.8 | 0.0056 | 2026-06-26 | Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. | |
CVE-2026-7871 |
critical | 9.8 | 0.0069 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with | |
CVE-2026-51947 |
critical | 9.8 | 0.0107 | 2026-07-01 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pi | |
CVE-2026-57621 |
critical | 9.8 | 0.0056 | 2026-07-02 | Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions. | |
CVE-2026-57677 |
critical | 9.8 | 0.0056 | 2026-07-02 | Unauthenticated PHP Object Injection in Novalnet Payment Gateway for WooCommerce <= 12.10.3 versions | |
CVE-2026-12481 |
critical | 9.8 | 0.0072 | 2026-07-03 | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improp | |
CVE-2026-43867 |
critical | 9.8 | 0.0093 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc compon | |
CVE-2026-33264 |
critical | 9.8 | 0.0165 | 2026-07-07 | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro | |
CVE-2026-57724 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This | |
CVE-2026-57744 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions a | |
CVE-2026-57770 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all | |
CVE-2026-59518 |
critical | 9.8 | 0.0056 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injec | |
CVE-2026-24227 |
critical | 9.8 | 0.0102 | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted | |
CVE-2026-64608 |
critical | 9.8 | 0.0081 | 2026-07-21 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deseria | |
CVE-2026-64606 |
critical | 9.8 | 0.0078 | 2026-07-21 | Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypas | |
CVE-2026-60367 |
critical | 9.8 | 0.0055 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-60372 |
critical | 9.8 | 0.0055 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-59544 |
critical | 9.8 | 0.0056 | 2026-07-23 | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | |
CVE-2026-63077 |
critical | 9.8 | 0.9356 | 2026-07-27 | JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unaut | KEV |
CVE-2026-66713 |
critical | 9.8 | 0.0172 | 2026-07-28 | Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache So | |
CVE-2026-14512 |
critical | 9.8 | 0.0097 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe | |
CVE-2026-14974 |
critical | 9.8 | 0.0068 | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute a | |
CVE-2026-12118 |
critical | 9.8 | 0.0085 | 2026-07-30 | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to | |
CVE-2026-61484 |
critical | 9.8 | 0.0081 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. T | |
CVE-2026-66909 |
critical | 9.8 | 0.0115 | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java | |
CVE-2026-28139 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | |
CVE-2026-65552 |
critical | 9.8 | 0.0056 | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | |
CVE-2026-65556 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. | |
CVE-2026-65571 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | |
CVE-2026-65572 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | |
CVE-2026-65573 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | |
CVE-2026-65574 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | |
CVE-2026-65575 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | |
CVE-2026-65576 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | |
CVE-2026-65577 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | |
CVE-2026-65578 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | |
CVE-2026-65579 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | |
CVE-2026-65581 |
critical | 9.8 | 0.0056 | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | |
CVE-2026-71558 |
critical | 9.8 | 0.0099 | 2026-08-07 | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache For | |
CVE-2026-28149 |
critical | 9.8 | 0.0056 | 2026-08-13 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | |
CVE-2026-32470 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | |
CVE-2026-59940 |
critical | 9.8 | 0.0081 | 2026-08-18 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap | |
CVE-2026-73341 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | |
CVE-2026-73366 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | |
CVE-2026-73376 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | |
CVE-2026-73380 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | |
CVE-2026-73397 |
critical | 9.8 | 0.0056 | 2026-08-18 | Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. |