Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-114197 |
high | 8.7 | 0.0015 | 2026-10-21 | Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary cod | |
CVE-2026-114198 |
high | 8.7 | 0.0015 | 2026-10-21 | Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary cod | |
CVE-2026-57845 |
high | 8.7 | 0.0055 | 2026-10-23 | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows a | 1 PoC |
CVE-2026-67615 |
high | 8.7 | 0.0054 | 2026-09-22 | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allow | |
CVE-2026-107238 |
high | 8.7 | — | 2026-10-29 | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the | |
CVE-2026-29001 |
high | 8.6 | 0.0079 | 2026-10-21 | TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated ad | |
CVE-2026-52751 |
high | 8.6 | 0.0071 | 2026-06-10 | Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RM | |
CVE-2026-10748 |
high | 8.6 | 0.0032 | 2026-06-16 | An authenticated user with the nx-licensing-create privilege can upload a specially crafted license | |
CVE-2026-57516 |
high | 8.6 | 0.0086 | 2026-07-01 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that a | |
CVE-2026-48397 |
high | 8.6 | 0.0097 | 2026-08-11 | Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result | |
CVE-2026-11536 |
high | 8.5 | 0.0058 | 2026-07-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability i | |
CVE-2026-7584 |
high | 8.4 | 0.0026 | 2026-05-01 | The LabOne Q serialization framework uses a class-loading mechanism (import_cls) to dynamically impo | |
CVE-2026-11857 |
high | 8.4 | 0.0027 | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Upda | |
CVE-2026-12578 |
high | 8.4 | 0.0037 | 2026-06-30 | The affected product is vulnerable to a deserialization of untrusted data, which may allow an attack | |
CVE-2026-24233 |
high | 8.4 | 0.0039 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model we | |
CVE-2026-18634 |
high | 8.4 | 0.0034 | 2026-08-11 | An insecure handling of serialized objects vulnerability was found in the one of the service of GMS | |
CVE-2026-73325 |
high | 8.4 | 0.0040 | 2026-08-12 | Fujitsu Research's OneCompression library before 1.2.1 contains an unsafe deserialization vulnerabil | |
CVE-2026-44901 |
high | 8.4 | 0.0075 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-16477 |
high | 8.4 | 0.0029 | 2026-10-22 | CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file ( | |
CVE-2026-58281 |
high | 8.3 | 0.0096 | 2026-07-11 | Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker | |
CVE-2026-47623 |
high | 8.2 | 0.0069 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of un | |
CVE-2026-93905 |
high | 8.2 | 0.0033 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated | |
CVE-2026-114724 |
high | 8.1 | 0.0026 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcu | |
CVE-2026-25524 |
high | 8.1 | 0.0063 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-27333 |
high | 8.1 | 0.0032 | 2026-06-15 | Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions. | |
CVE-2026-39443 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions. | |
CVE-2026-39446 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions. | |
CVE-2026-39539 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions. | |
CVE-2026-39545 |
high | 8.1 | 0.0040 | 2026-06-17 | Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions. | |
CVE-2026-39554 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. | |
CVE-2026-39557 |
high | 8.1 | 0.0040 | 2026-06-17 | Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions. | |
CVE-2026-39567 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. | |
CVE-2026-39573 |
high | 8.1 | 0.0040 | 2026-06-17 | Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions. | |
CVE-2026-39580 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | |
CVE-2026-40735 |
high | 8.1 | 0.0040 | 2026-06-17 | Unauthenticated PHP Object Injection in Reina <= 2.1 versions. | |
CVE-2026-40736 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions. | |
CVE-2026-40739 |
high | 8.1 | 0.0032 | 2026-06-17 | Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions. | |
CVE-2026-40751 |
high | 8.1 | 0.0032 | 2026-06-17 | Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | |
CVE-2026-40753 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions. | |
CVE-2026-40754 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Roisin <= 1.4 versions. | |
CVE-2026-40755 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | |
CVE-2026-40758 |
high | 8.1 | 0.0032 | 2026-06-17 | Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. | |
CVE-2026-40759 |
high | 8.1 | 0.0032 | 2026-06-17 | Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. | |
CVE-2026-40760 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Behold <= 1.5 versions. | |
CVE-2026-40761 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions. | |
CVE-2026-39442 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions. | |
CVE-2026-39445 |
high | 8.1 | 0.0040 | 2026-06-17 | Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions. | |
CVE-2026-39556 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Konsept <= 1.9 versions. | |
CVE-2026-39560 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions. | |
CVE-2026-39576 |
high | 8.1 | 0.0040 | 2026-06-17 | Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions. |