Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-32563 |
critical | 9.8 | 0.0056 | 2026-08-24 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 ver | |
CVE-2026-112862 |
critical | 9.8 | 0.0041 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants | |
CVE-2026-112846 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object | |
CVE-2026-112847 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection. | |
CVE-2026-112848 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Inje | |
CVE-2026-112851 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Inje | |
CVE-2026-112853 |
critical | 9.8 | 0.0041 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object I | |
CVE-2026-112854 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allow | |
CVE-2026-112855 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.Thi | |
CVE-2026-112856 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object | |
CVE-2026-112857 |
critical | 9.8 | 0.0041 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injecti | |
CVE-2026-112858 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection | |
CVE-2026-112859 |
critical | 9.8 | 0.0031 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allo | |
CVE-2026-114196 |
critical | 9.8 | 0.0045 | 2026-10-24 | Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Inje | |
CVE-2026-94075 |
critical | 9.8 | 0.0045 | 2026-10-24 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite a | |
CVE-2026-105192 |
critical | 9.8 | 0.0077 | 2026-10-07 | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so w | 1 PoC |
CVE-2026-54856 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |
CVE-2026-54857 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |
CVE-2026-54858 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |
CVE-2026-54859 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | |
CVE-2026-54860 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
CVE-2026-61992 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | |
CVE-2026-61997 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
CVE-2026-61998 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |
CVE-2026-62001 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | |
CVE-2026-62002 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |
CVE-2026-62003 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
CVE-2026-62004 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
CVE-2026-62005 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
CVE-2026-62006 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
CVE-2026-62008 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
CVE-2026-62009 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
CVE-2026-62010 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
CVE-2026-62011 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
CVE-2026-62012 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
CVE-2026-62013 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
CVE-2026-62014 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
CVE-2026-62015 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
CVE-2026-62016 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
CVE-2026-62017 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
CVE-2026-62018 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
CVE-2026-62131 |
critical | 9.8 | — | 2026-10-29 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
CVE-2026-27303 |
critical | 9.6 | 0.0061 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data | |
CVE-2026-34659 |
critical | 9.6 | 0.0063 | 2026-05-12 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by a Deserialization of Untrus | |
CVE-2026-12046 |
critical | 9.5 | 0.0104 | 2026-06-19 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_i | |
CVE-2026-48909 |
critical | 9.5 | 0.0494 | 2026-06-20 | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without validation | |
CVE-2025-30047 |
critical | 9.4 | 0.0038 | 2026-10-23 | CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The | |
CVE-2025-64393 |
critical | 9.4 | 0.0520 | 2026-10-07 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as | |
CVE-2026-39324 |
critical | 9.3 | 0.0027 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Ses | |
CVE-2026-40044 |
critical | 9.3 | 0.0048 | 2026-04-13 | Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attackers to execu |