Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-35337 |
high | 8.8 | 0.0101 | 2026-04-13 | Deserialization of Untrusted Data vulnerability in Apache Storm. Versions Affected: before 2.8.6. | |
CVE-2026-33858 |
high | 8.8 | 0.0059 | 2026-04-13 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XC | |
CVE-2026-24186 |
high | 8.8 | 0.0048 | 2026-04-28 | NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of u | |
CVE-2026-33110 |
high | 8.8 | 0.0197 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-33112 |
high | 8.8 | 0.3112 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-35439 |
high | 8.8 | 0.0203 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-40357 |
high | 8.8 | 0.0170 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-39474 |
high | 8.8 | 0.0043 | 2026-06-15 | Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. | |
CVE-2026-39478 |
high | 8.8 | 0.0043 | 2026-06-15 | Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versio | |
CVE-2026-39532 |
high | 8.8 | 0.0034 | 2026-06-15 | Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions. | |
CVE-2026-12256 |
high | 8.8 | 0.0047 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in ThemeFusion Fusion Builder fusion-builder allows | |
CVE-2026-41862 |
high | 8.8 | 0.0076 | 2026-06-23 | Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialis | |
CVE-2026-56053 |
high | 8.8 | 0.0052 | 2026-06-25 | Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. | |
CVE-2026-56055 |
high | 8.8 | 0.0052 | 2026-06-26 | Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions. | |
CVE-2026-13759 |
high | 8.8 | 0.0055 | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje | |
CVE-2026-27060 |
high | 8.8 | 0.0052 | 2026-07-02 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object | |
CVE-2026-27414 |
high | 8.8 | 0.0052 | 2026-07-02 | Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. | |
CVE-2026-56037 |
high | 8.8 | 0.0052 | 2026-07-02 | Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. T | |
CVE-2026-14534 |
high | 8.8 | 0.0059 | 2026-07-04 | Trail of Bits fickling versions up to and including 0.1.10 do not include the Python standard librar | |
CVE-2026-46590 |
high | 8.8 | 0.0084 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc compon | |
CVE-2026-54469 |
high | 8.8 | 0.0086 | 2026-07-10 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untruste | |
CVE-2026-57371 |
high | 8.8 | 0.0052 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object In | |
CVE-2026-57713 |
high | 8.8 | 0.0046 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manage | |
CVE-2026-60373 |
high | 8.8 | 0.0047 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-60439 |
high | 8.8 | 0.0047 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-61246 |
high | 8.8 | 0.0047 | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen | |
CVE-2026-65617 |
high | 8.8 | 0.0065 | 2026-07-27 | A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user t | |
CVE-2026-71281 |
high | 8.8 | 0.0050 | 2026-08-05 | Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~1 | |
CVE-2026-58076 |
high | 8.8 | 0.0048 | 2026-08-12 | Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a | |
CVE-2026-67587 |
high | 8.8 | 0.0061 | 2026-08-12 | Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constru | |
CVE-2026-28176 |
high | 8.8 | 0.0046 | 2026-08-13 | Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions. | |
CVE-2026-32465 |
high | 8.8 | 0.0052 | 2026-08-18 | Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | |
CVE-2026-74012 |
high | 8.8 | 0.0052 | 2026-08-18 | Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue af | |
CVE-2026-12148 |
high | 8.8 | 0.0040 | 2026-10-19 | IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially ex | |
CVE-2026-82814 |
high | 8.8 | 0.0073 | 2026-10-21 | The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in al | |
CVE-2026-113779 |
high | 8.8 | 0.0041 | 2026-10-21 | The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and p | |
CVE-2026-104324 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitra | |
CVE-2026-116866 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | |
CVE-2026-116867 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | |
CVE-2026-116868 |
high | 8.8 | — | 2026-10-29 | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. | |
CVE-2026-118073 |
high | 8.8 | — | 2026-10-29 | Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. | |
CVE-2026-118075 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | |
CVE-2026-118076 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | |
CVE-2026-118080 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | |
CVE-2026-118081 |
high | 8.8 | — | 2026-10-29 | Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | |
CVE-2024-58381 |
high | 8.7 | 0.0077 | 2026-09-09 | PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processin | |
CVE-2026-41957 |
high | 8.7 | 0.0051 | 2026-05-13 | An authenticated remote code execution vulnerability through undisclosed vectors exists in the BIG-I | |
CVE-2026-47161 |
high | 8.7 | 0.0064 | 2026-05-27 | RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, | |
CVE-2026-57527 |
high | 8.7 | 0.0068 | 2026-06-26 | Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulner | |
CVE-2026-21655 |
high | 8.7 | 0.0049 | 2026-07-23 | Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Contro |