Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-77646 |
high | 7.7 | 0.0044 | 2026-08-20 | A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PT | |
CVE-2026-112304 |
high | 7.7 | 0.0037 | 2026-10-19 | docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() tha | |
CVE-2026-119120 |
high | 7.7 | — | 2026-10-29 | Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Do | |
CVE-2026-58233 |
high | 7.6 | 0.0056 | 2026-07-14 | SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a | |
CVE-2026-50652 |
high | 7.5 | 0.0173 | 2026-07-14 | Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny | |
CVE-2026-25204 |
high | 7.5 | 0.0030 | 2026-04-13 | Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows d | |
CVE-2026-33337 |
high | 7.5 | 0.0054 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 | |
CVE-2026-54499 |
high | 7.5 | 0.0052 | 2026-07-08 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of | |
CVE-2026-65493 |
high | 7.5 | 0.0040 | 2026-07-23 | Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions. | |
CVE-2026-71559 |
high | 7.5 | 0.0080 | 2026-08-07 | Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an at | |
CVE-2026-67579 |
high | 7.5 | 0.0061 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacke | |
CVE-2026-105013 |
high | 7.4 | 0.0095 | 2026-10-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2026-47058 |
high | 7.4 | 0.0039 | 2026-07-21 | Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Or | |
CVE-2024-53326 |
high | 7.3 | 0.0049 | 2026-05-08 | LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager | |
CVE-2026-24156 |
high | 7.3 | 0.0026 | 2026-04-07 | NVIDIA DALI contains a vulnerability where an attacker could cause a deserialization of untrusted da | |
CVE-2026-7818 |
high | 7.3 | 0.0013 | 2026-05-11 | Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager. The session mana | |
CVE-2026-43866 |
high | 7.3 | 0.0065 | 2026-07-06 | Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBin | |
CVE-2026-43825 |
high | 7.3 | 0.1392 | 2026-07-06 | Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected: before 3.0.0-M | |
CVE-2026-67260 |
high | 7.3 | 0.0078 | 2026-08-12 | Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task | |
CVE-2026-116580 |
high | 7.3 | 0.0034 | 2026-10-26 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.strin | |
CVE-2026-116392 |
high | 7.2 | 0.0030 | 2026-10-28 | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object In | |
CVE-2026-115590 |
high | 7.2 | 0.0030 | 2026-10-28 | Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.T | |
CVE-2026-116390 |
high | 7.2 | 0.0030 | 2026-10-28 | Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & | |
CVE-2026-29782 |
high | 7.2 | 0.0057 | 2026-04-02 | OpenSTAManager is an open source management software for technical assistance and invoicing. Prior t | |
CVE-2026-25917 |
high | 7.2 | 0.0082 | 2026-04-18 | Dag Authors, who normally should not be able to execute code in the webserver context could craft XC | |
CVE-2026-39434 |
high | 7.2 | 0.0045 | 2026-06-15 | Shop manager PHP Object Injection in CTX Feed <= 6.6.26 versions. | |
CVE-2026-39471 |
high | 7.2 | 0.0045 | 2026-06-15 | Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. | |
CVE-2026-39472 |
high | 7.2 | 0.0045 | 2026-06-15 | Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions. | |
CVE-2026-39481 |
high | 7.2 | 0.0045 | 2026-06-15 | Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. | |
CVE-2026-39498 |
high | 7.2 | 0.0036 | 2026-06-15 | Shop manager PHP Object Injection in YayMail <= 4.3.3 versions. | |
CVE-2026-39499 |
high | 7.2 | 0.0045 | 2026-06-15 | Shop manager PHP Object Injection in Advanced Product Fields (Product Addons) for WooCommerce <= 1.6 | |
CVE-2026-59521 |
high | 7.2 | 0.0054 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-fr | |
CVE-2026-65497 |
high | 7.2 | 0.0054 | 2026-07-23 | Administrator PHP Object Injection in Complianz <= 7.5.0 versions. | |
CVE-2026-65549 |
high | 7.2 | 0.0054 | 2026-08-06 | Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions. | |
CVE-2026-27380 |
high | 7.2 | 0.0054 | 2026-08-13 | Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | |
CVE-2026-66620 |
high | 7.2 | 0.0054 | 2026-08-18 | Editor PHP Object Injection in OptionTree <= 2.7.3 versions. | |
CVE-2026-114624 |
high | 7.2 | 0.0061 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-114704 |
high | 7.2 | 0.0041 | 2026-10-24 | Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allow | |
CVE-2026-116864 |
high | 7.2 | — | 2026-10-29 | Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | |
CVE-2026-116865 |
high | 7.2 | — | 2026-10-29 | Editor PHP Object Injection in Zippy <= 1.7.0 versions. | |
CVE-2026-116869 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | |
CVE-2026-118074 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | |
CVE-2026-118077 |
high | 7.2 | — | 2026-10-29 | Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | |
CVE-2026-118078 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. | |
CVE-2026-118079 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions. | |
CVE-2026-42701 |
high | 7.2 | — | 2026-10-29 | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | |
CVE-2026-8727 |
high | 7.1 | 0.0039 | 2026-05-19 | The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP' | |
CVE-2026-45134 |
high | 7.1 | 0.0020 | 2026-05-27 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith | |
CVE-2026-55153 |
high | 7.1 | 0.0019 | 2026-07-01 | mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c | |
CVE-2026-109361 |
high | 7.0 | 0.0023 | 2026-10-12 | MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that u |