Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-25874 |
critical | 9.3 | 0.1555 | 2026-04-23 | LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeli | |
CVE-2026-26210 |
critical | 9.3 | 0.0070 | 2026-04-23 | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balance_serve ba | |
CVE-2026-41586 |
critical | 9.3 | 0.0053 | 2026-05-07 | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing s | |
CVE-2026-53805 |
critical | 9.3 | 0.0087 | 2026-06-17 | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vuln | |
CVE-2026-56121 |
critical | 9.3 | 0.0141 | 2026-06-24 | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or | |
CVE-2026-58126 |
critical | 9.3 | 0.0184 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows | |
CVE-2026-58127 |
critical | 9.3 | 0.0188 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerE | |
CVE-2026-63767 |
critical | 9.3 | 0.0112 | 2026-07-20 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserializa | |
CVE-2026-68771 |
critical | 9.3 | 0.0115 | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node tha | |
CVE-2026-69098 |
critical | 9.3 | 0.0091 | 2026-08-04 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection e | |
CVE-2026-70554 |
critical | 9.3 | 0.0123 | 2026-08-04 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to e | |
CVE-2025-25034 |
critical | 9.3 | 0.0496 | 2025-06-20 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7 | |
CVE-2023-22793 |
critical | 9.3 | — | 2026-10-29 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on serve | |
CVE-2026-114403 |
critical | 9.2 | 0.0070 | 2026-10-21 | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allo | |
CVE-2026-44126 |
critical | 9.2 | 0.0047 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data, which ca | |
CVE-2026-46725 |
critical | 9.2 | 0.0262 | 2026-05-19 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely pr | |
CVE-2026-48853 |
critical | 9.2 | 0.0078 | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabi | |
CVE-2026-45034 |
critical | 9.2 | 0.0046 | 2026-06-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.5, CVE | |
CVE-2026-77645 |
critical | 9.2 | 0.0056 | 2026-08-20 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC Flex | |
CVE-2026-109391 |
critical | 9.2 | 0.0048 | 2026-10-12 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows | |
CVE-2026-5426 |
critical | 9.1 | 0.0101 | 2026-04-16 | Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to F | |
CVE-2026-71560 |
critical | 9.1 | 0.0077 | 2026-08-07 | Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory | |
CVE-2026-76404 |
critical | 9.1 | 0.0075 | 2026-08-19 | In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execut | |
CVE-2026-16723 |
critical | 9.0 | 0.0066 | 2026-07-23 | A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerabi | |
CVE-2026-103693 |
critical | 9.0 | 0.0024 | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 d | |
CVE-2026-115912 |
high | 8.8 | 0.0051 | 2026-10-26 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, an authenticated | |
CVE-2026-75891 |
high | 8.8 | 0.0031 | 2026-10-27 | The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all | |
CVE-2026-1928 |
high | 8.8 | 0.0054 | 2026-10-28 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP | |
CVE-2026-116391 |
high | 8.8 | 0.0037 | 2026-10-28 | Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows O | |
CVE-2026-116389 |
high | 8.8 | 0.0029 | 2026-10-28 | Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-renam | |
CVE-2026-64901 |
high | 8.8 | 0.0204 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-66805 |
high | 8.8 | 0.0204 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-66808 |
high | 8.8 | 0.0204 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-63514 |
high | 8.8 | 0.0204 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-65658 |
high | 8.8 | 0.0204 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-65663 |
high | 8.8 | 0.0204 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-65665 |
high | 8.8 | 0.0169 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-65815 |
high | 8.8 | 0.0169 | 2026-08-11 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attac | |
CVE-2026-70321 |
high | 8.8 | 0.0169 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-100214 |
high | 8.8 | 0.0207 | 2026-10-13 | Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to exec | |
CVE-2026-70035 |
high | 8.8 | 0.0143 | 2026-10-13 | Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code | |
CVE-2026-83520 |
high | 8.8 | 0.0143 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a net | |
CVE-2026-65674 |
high | 8.8 | 0.0162 | 2026-10-13 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a | |
CVE-2026-85900 |
high | 8.8 | 0.0152 | 2026-10-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-87697 |
high | 8.8 | 0.0084 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a net | |
CVE-2023-30898 |
high | 8.8 | 0.0111 | 2023-05-09 | A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), | |
CVE-2023-30899 |
high | 8.8 | 0.0111 | 2023-05-09 | A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), | |
CVE-2023-2288 |
high | 8.8 | 0.1797 | 2023-05-30 | The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before per | |
CVE-2025-62035 |
high | 8.8 | 0.0045 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a | |
CVE-2025-69035 |
high | 8.8 | 0.0042 | 2026-01-22 | Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt a |