Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40733 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions. | |
CVE-2026-40738 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions. | |
CVE-2026-40752 |
high | 8.1 | 0.0031 | 2026-06-17 | Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions. | |
CVE-2026-40756 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Zoya <= 1.4 versions. | |
CVE-2026-40757 |
high | 8.1 | 0.0025 | 2026-06-17 | Unauthenticated PHP Object Injection in Château <= 1.2.1 versions. | |
CVE-2026-49286 |
high | 8.1 | 0.0073 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version | |
CVE-2026-39253 |
high | 8.1 | 0.0072 | 2026-06-23 | An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivot | |
CVE-2026-54512 |
high | 8.1 | 0.0094 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-56031 |
high | 8.1 | 0.0044 | 2026-06-26 | Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. | |
CVE-2026-40859 |
high | 8.1 | 0.0089 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component des | |
CVE-2026-42527 |
high | 8.1 | 0.0067 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter patt | |
CVE-2026-43865 |
high | 8.1 | 0.0098 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-haze | |
CVE-2026-13185 |
high | 8.1 | 0.0067 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in R | |
CVE-2026-13190 |
high | 8.1 | 0.0050 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persi | |
CVE-2026-112852 |
high | 8.1 | 0.0026 | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Inject | |
CVE-2026-104317 |
high | 8.1 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message brok | |
CVE-2026-40368 |
high | 8.0 | 0.0182 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-115190 |
high | 8.0 | 0.0049 | 2026-10-26 | An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segm | |
CVE-2026-50646 |
high | 7.8 | 0.0402 | 2026-07-14 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local | |
CVE-2026-50649 |
high | 7.8 | 0.0402 | 2026-07-14 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. | |
CVE-2026-118613 |
high | 7.8 | 0.0024 | 2026-10-28 | Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This v | |
CVE-2026-118617 |
high | 7.8 | 0.0026 | 2026-10-28 | Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerab | |
CVE-2026-50509 |
high | 7.8 | 0.0353 | 2026-07-14 | Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized | |
CVE-2026-55009 |
high | 7.8 | 0.0251 | 2026-07-14 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev | |
CVE-2026-96186 |
high | 7.8 | 0.0240 | 2026-10-13 | Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacke | |
CVE-2026-87692 |
high | 7.8 | 0.0168 | 2026-10-13 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev | |
CVE-2026-88091 |
high | 7.8 | 0.0293 | 2026-10-13 | Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacke | |
CVE-2026-1839 |
high | 7.8 | 0.0038 | 2026-04-07 | A vulnerability in the HuggingFace Transformers library, specifically in the `Trainer` class, allows | |
CVE-2026-32184 |
high | 7.8 | 0.0193 | 2026-04-14 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an authori | |
CVE-2026-32192 |
high | 7.8 | 0.0192 | 2026-04-14 | Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate pr | |
CVE-2026-24228 |
high | 7.8 | 0.0016 | 2026-06-16 | NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization | |
CVE-2026-10043 |
high | 7.8 | 0.0055 | 2026-06-24 | MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulner | |
CVE-2026-46607 |
high | 7.8 | 0.0019 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py | |
CVE-2026-24240 |
high | 7.8 | 0.0043 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat | |
CVE-2026-24243 |
high | 7.8 | 0.0043 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat | |
CVE-2026-24244 |
high | 7.8 | 0.0043 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat | |
CVE-2026-24245 |
high | 7.8 | 0.0043 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat | |
CVE-2026-24247 |
high | 7.8 | 0.0043 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat | |
CVE-2026-24250 |
high | 7.8 | 0.0040 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper val | |
CVE-2026-24251 |
high | 7.8 | 0.0040 | 2026-07-01 | NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper con | |
CVE-2026-14637 |
high | 7.8 | 0.0083 | 2026-07-04 | A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd | |
CVE-2026-47472 |
high | 7.8 | 0.0035 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attac | |
CVE-2026-12484 |
high | 7.8 | 0.0030 | 2026-07-19 | A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-control | |
CVE-2026-18642 |
high | 7.8 | 0.0037 | 2026-08-03 | Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Ins | |
CVE-2026-60392 |
high | 7.8 | 0.0032 | 2026-08-18 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou | |
CVE-2026-60412 |
high | 7.8 | 0.0032 | 2026-08-18 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou | |
CVE-2026-18285 |
high | 7.8 | 0.0055 | 2026-08-20 | Aeon load_rehab_pile_dataset Deserialization of Untrusted Data Remote Code Execution Vulnerability. | |
CVE-2026-91459 |
high | 7.8 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou | |
CVE-2026-91460 |
high | 7.8 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou | |
CVE-2026-91483 |
high | 7.8 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou |