Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-13371 |
medium | 6.9 | 0.0059 | 2026-07-03 | An authenticated administrator can trigger a denial-of-service condition in the Fireware Management | |
CVE-2026-75987 |
medium | 6.9 | 0.0056 | 2026-08-19 | A vulnerability was found in SPLWare esProc up to 20260507. This affects the function ObjectInputStr | |
CVE-2026-48917 |
medium | 6.6 | 0.0026 | 2026-05-27 | Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without vali | |
CVE-2026-68756 |
medium | 6.6 | 0.0047 | 2026-08-12 | A party with write access to stored session data may affect JFrog Artifactory under specific conditi | |
CVE-2026-62912 |
medium | 6.5 | 0.0198 | 2026-08-11 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny | |
CVE-2026-63516 |
medium | 6.5 | 0.0187 | 2026-08-11 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to pe | |
CVE-2026-42521 |
medium | 6.5 | 0.0025 | 2026-04-29 | Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes param | |
CVE-2026-27410 |
medium | 6.5 | 0.0027 | 2026-06-17 | Unauthenticated Deserialization of untrusted data in Slimstat Analytics < 5.4.0 versions. | |
CVE-2026-12155 |
medium | 6.5 | 0.0026 | 2026-10-19 | IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially craft | |
CVE-2026-12350 |
medium | 6.5 | 0.0026 | 2026-10-19 | IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially cra | |
CVE-2026-24220 |
medium | 6.4 | 0.0033 | 2026-07-14 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacke | |
CVE-2026-55223 |
medium | 6.3 | 0.0048 | 2026-06-30 | c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with ot | |
CVE-2026-58025 |
medium | 5.9 | 0.0050 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerabil | |
CVE-2026-69659 |
medium | 5.9 | 0.0036 | 2026-08-09 | Uncontrolled Resource Consumption vulnerability in ash-project ash allows an attacker to exhaust the | |
CVE-2026-39577 |
medium | 5.5 | 0.0021 | 2026-06-17 | Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. | |
CVE-2026-39578 |
medium | 5.5 | 0.0027 | 2026-06-17 | Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. | |
CVE-2026-59242 |
medium | 5.4 | 0.0053 | 2026-08-12 | Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a strin | |
CVE-2026-114608 |
medium | 5.4 | 0.0011 | 2026-10-22 | Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistic | |
CVE-2026-116098 |
medium | 5.3 | 0.0032 | 2026-10-26 | A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the func | |
CVE-2026-8612 |
medium | 5.3 | 0.0013 | 2026-05-15 | WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world- | |
CVE-2026-15529 |
medium | 5.3 | 0.0044 | 2026-07-13 | A vulnerability was detected in yzhao062 pyod up to 3.6.1. Affected is the function pyod.utils.persi | |
CVE-2026-3048 |
medium | 5.1 | 0.0017 | 2026-05-11 | An authenticated administrator who configures or tests LDAP connectivity in Sonatype Nexus Repositor | |
CVE-2026-14723 |
medium | 4.8 | 0.0032 | 2026-07-05 | A vulnerability was determined in AD-Security AD_Miner 1.9.0. Affected is the function request_a of | |
CVE-2026-24232 |
medium | 4.3 | 0.0038 | 2026-07-21 | NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserializati | |
CVE-2026-91333 |
low | 3.7 | 0.0027 | 2026-10-20 | Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Ora | |
CVE-2026-9828 |
low | 2.9 | 0.0037 | 2026-05-28 | Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectI | |
CVE-2026-111628 |
low | 2.3 | 0.0027 | 2026-10-16 | 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor- | |
CVE-2026-116230 |
low | 2.1 | 0.0032 | 2026-10-26 | A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected e | |
CVE-2026-5659 |
low | 2.1 | 0.0026 | 2026-04-06 | A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.l | |
CVE-2026-7597 |
low | 2.1 | 0.0032 | 2026-05-01 | A vulnerability was found in mem0ai mem0 up to 1.0.11. This affects the function pickle.load/pickle. | |
CVE-2026-8735 |
low | 2.1 | 0.0024 | 2026-05-17 | A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.par | |
CVE-2026-12787 |
low | 2.1 | 0.0041 | 2026-06-21 | A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. | |
CVE-2026-15535 |
low | 2.1 | 0.0043 | 2026-07-13 | A vulnerability was determined in AkariAsai self-rag up to 1fcdc420e48f50a7d7ab1ece5494221b93252e99. | |
CVE-2026-112081 |
low | 2.1 | 0.0034 | 2026-10-19 | A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp. | |
CVE-2026-15531 |
low | 1.9 | 0.0032 | 2026-07-13 | A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b | |
CVE-2017-12149 |
— | — | 0.9071 | — | The JBoss Application Server, shipped with Red Hat Enterprise Application Platform 5.2, allows an at | KEV |
CVE-2020-0618 |
— | — | 0.9905 | — | Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page | KEV |
CVE-2021-26857 |
— | — | 0.9576 | — | Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code executio | KEV |
CVE-2021-42237 |
— | — | 0.9757 | — | Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execut | KEV |
CVE-2021-23758 |
— | — | 0.8258 | — | Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that coul | KEV |
CVE-2021-44228 |
— | — | 1.0000 | — | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlle | KEV |
CVE-2023-0669 |
— | — | 1.0000 | — | Fortra (formerly, HelpSystems) GoAnywhere MFT contains a pre-authentication remote code execution vu | KEV |
CVE-2023-21529 |
— | — | 0.5929 | — | Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated | KEV |
CVE-2025-23006 |
— | — | 0.2343 | — | SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC) contain a | KEV |
CVE-2025-42999 |
— | — | 0.1285 | — | SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows | KEV |
CVE-2025-53770 |
— | — | 1.0000 | — | Microsoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability t | KEV |
CVE-2025-8875 |
— | — | 0.0251 | — | N-able N-Central contains an insecure deserialization vulnerability that could lead to command execu | KEV |
CVE-2025-53690 |
— | — | 0.6060 | — | Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cl | KEV |
CVE-2025-10035 |
— | — | 0.9982 | — | Fortra GoAnywhere MFT contains a deserialization of untrusted data vulnerability allows an actor wit | KEV |
CVE-2025-26399 |
— | — | 0.9012 | — | SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that | KEV |