Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-114665 |
high | 7.1 | 0.0035 | 2026-10-22 | Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /dep | |
CVE-2026-93864 |
high | 7.1 | 0.0013 | 2026-10-27 | A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker w | |
CVE-2026-49791 |
high | 7.1 | 0.0038 | 2026-07-14 | Improper link resolution before file access ('link following') in Windows Routing and Remote Access | |
CVE-2026-54056 |
high | 7.1 | 0.0027 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow | |
CVE-2026-14904 |
high | 7.1 | 0.0057 | 2026-07-07 | AWS Research and Engineering Studio (RES) is an open-source solution that enables researchers and en | |
CVE-2026-50163 |
high | 7.1 | 0.0040 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/u | |
CVE-2026-70622 |
high | 7.1 | 0.0046 | 2026-08-10 | tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_ | |
CVE-2026-71964 |
high | 7.1 | 0.0046 | 2026-08-10 | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file | |
CVE-2026-112940 |
high | 7.1 | 0.0019 | 2026-10-20 | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let | |
CVE-2026-50526 |
high | 7.0 | 0.0022 | 2026-07-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker | |
CVE-2026-83793 |
high | 7.0 | 0.0032 | 2026-10-13 | Improper link resolution before file access ('link following') in Windows Update Orchestrator Servic | |
CVE-2026-108135 |
high | 7.0 | 0.0030 | 2026-10-13 | Improper link resolution before file access ('link following') in Windows Backup Engine allows an au | |
CVE-2026-50656 |
high | 7.0 | 0.1116 | 2026-06-16 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Micros | |
CVE-2026-76496 |
high | 7.0 | 0.0016 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa | |
CVE-2026-0827 |
medium | 6.9 | 0.0021 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnosti | |
CVE-2026-6941 |
medium | 6.9 | 0.0022 | 2026-04-23 | radare2 prior to 6.1.4 contains a path traversal vulnerability in its project notes handling that al | |
CVE-2026-47833 |
medium | 6.9 | 0.0017 | 2026-06-18 | setupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation via | |
CVE-2026-50135 |
medium | 6.9 | 0.0041 | 2026-07-06 | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot | |
CVE-2026-12036 |
medium | 6.9 | 0.0016 | 2026-08-13 | An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and | |
CVE-2026-53785 |
medium | 6.9 | 0.0019 | 2026-08-13 | rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write f | |
CVE-2026-63426 |
medium | 6.9 | 0.0016 | 2026-08-13 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Mana | |
CVE-2026-110860 |
medium | 6.9 | 0.0019 | 2026-10-14 | GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which chec | |
CVE-2026-115378 |
medium | 6.9 | 0.0029 | 2026-10-22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vuln | |
CVE-2026-116213 |
medium | 6.9 | 0.0045 | 2026-10-26 | Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writ | |
CVE-2026-56236 |
medium | 6.8 | 0.0018 | 2026-06-21 | Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build crede | |
CVE-2026-56692 |
medium | 6.8 | 0.0017 | 2026-06-23 | NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allow | |
CVE-2026-104109 |
medium | 6.8 | 0.0032 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operatio | |
CVE-2026-65680 |
medium | 6.7 | 0.0039 | 2026-08-11 | Improper link resolution before file access ('link following') in Microsoft OneDrive allows an autho | |
CVE-2026-70165 |
medium | 6.7 | 0.0037 | 2026-10-13 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker | |
CVE-2026-28684 |
medium | 6.6 | 0.0025 | 2026-04-20 | python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prio | |
CVE-2026-35365 |
medium | 6.6 | 0.0016 | 2026-04-22 | The mv utility in uutils coreutils improperly handles directory trees containing symbolic links duri | |
CVE-2023-4052 |
medium | 6.5 | 0.0071 | 2023-08-01 | The Firefox updater created a directory writable by non-privileged users. When uninstalling Firefox, | |
CVE-2026-11853 |
medium | 6.5 | 0.0027 | 2026-06-10 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. De | |
CVE-2026-13723 |
medium | 6.5 | 0.0048 | 2026-07-29 | A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker t | |
CVE-2026-7832 |
medium | 6.4 | 0.0013 | 2026-05-05 | A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of | |
CVE-2026-47699 |
medium | 6.4 | 0.0029 | 2026-08-18 | Confidential Containers Guest Components provides guest tools and components for confidential contai | |
CVE-2026-108332 |
medium | 6.3 | 0.0015 | 2026-10-27 | Tanium addressed an improper link resolution before file access vulnerability in Threat Response Cli | |
CVE-2026-64613 |
medium | 6.2 | 0.0018 | 2026-07-21 | Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and ope | |
CVE-2026-53765 |
medium | 6.1 | 0.0010 | 2026-06-24 | Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live C | |
CVE-2026-53766 |
medium | 6.1 | 0.0012 | 2026-06-24 | Chrome DevTools for agents (chrome-devtools-mcp) lets your coding agent control and inspect a live C | |
CVE-2026-47121 |
medium | 6.1 | 0.0034 | 2026-07-21 | Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaA | |
CVE-2026-6959 |
medium | 6.0 | 0.0017 | 2026-05-12 | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to arbitrary file read and write | |
CVE-2026-8052 |
medium | 6.0 | 0.0013 | 2026-05-12 | HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on | |
CVE-2026-114462 |
medium | 6.0 | 0.0031 | 2026-10-21 | Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This | |
CVE-2026-58403 |
medium | 5.9 | 0.0047 | 2026-07-06 | Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is design | |
CVE-2026-12345 |
medium | 5.9 | 0.0034 | 2026-09-29 | The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can mo | |
CVE-2026-76654 |
medium | 5.8 | 0.0043 | 2026-10-26 | An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMo | |
CVE-2026-67433 |
medium | 5.8 | 0.0010 | 2026-07-29 | Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related mo | |
CVE-2026-53796 |
medium | 5.8 | 0.0013 | 2026-08-13 | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in | |
CVE-2026-53797 |
medium | 5.7 | 0.0014 | 2026-08-13 | rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree trave |