Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-55447 |
critical | 9.6 | 0.0066 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by co | |
CVE-2026-115392 |
high | 8.8 | 0.0024 | 2026-10-22 | Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allow | |
CVE-2026-118688 |
high | 8.8 | 0.0024 | 2026-10-28 | wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends | |
CVE-2026-42275 |
high | 8.7 | 0.0033 | 2026-05-08 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the | |
CVE-2026-56748 |
high | 8.7 | 0.0092 | 2026-07-27 | Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 a | |
CVE-2026-41937 |
high | 8.6 | 0.0040 | 2026-05-14 | Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoin | |
CVE-2026-56876 |
high | 8.6 | 0.0053 | 2026-06-26 | extract-zip does not validate symlink targets when extracting zip archives. When processing a malici | |
CVE-2026-12958 |
high | 8.5 | 0.0019 | 2026-06-23 | Missing symlink validation in Language Servers for AWS may allow an arbitrary file write outside of | |
CVE-2026-53802 |
high | 8.4 | 0.0024 | 2026-08-13 | rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files | |
CVE-2026-49248 |
high | 8.3 | 0.0057 | 2026-06-18 | OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.unta | |
CVE-2026-54574 |
high | 8.2 | 0.0021 | 2026-07-29 | proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro instal | |
CVE-2026-39822 |
high | 7.8 | 0.0023 | 2026-07-08 | On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of th | |
CVE-2026-39861 |
high | 7.7 | 0.0071 | 2026-04-21 | Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not preven | |
CVE-2026-56815 |
high | 7.4 | 0.0017 | 2026-06-23 | pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in th | |
CVE-2026-115908 |
high | 7.4 | 0.0043 | 2026-10-26 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9 | |
CVE-2026-22767 |
high | 7.3 | 0.0017 | 2026-04-01 | Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. | |
CVE-2026-13201 |
high | 7.3 | 0.0031 | 2026-06-24 | A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function us | |
CVE-2026-12080 |
high | 7.3 | 0.0014 | 2026-07-20 | A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerabilit | |
CVE-2026-7819 |
high | 7.2 | 0.0032 | 2026-05-11 | Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission us | |
CVE-2026-59674 |
high | 7.1 | 0.0017 | 2026-07-14 | A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allow | |
CVE-2026-97023 |
high | 7.1 | 0.0037 | 2026-09-28 | A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployme | |
CVE-2026-97024 |
high | 7.1 | 0.0038 | 2026-09-29 | A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deploymen | |
CVE-2026-21916 |
high | 7.0 | 0.0013 | 2026-04-09 | A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allow | |
CVE-2026-62992 |
medium | 6.9 | 0.0053 | 2026-08-07 | Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from app | |
CVE-2026-35632 |
medium | 6.9 | 0.0032 | 2026-04-09 | OpenClaw before 2026.3.24 contains a symlink traversal vulnerability in agents.create and agents.upd | |
CVE-2026-47763 |
medium | 6.8 | 0.0020 | 2026-08-04 | pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prio | |
CVE-2026-28684 |
medium | 6.6 | 0.0025 | 2026-04-20 | python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prio | |
CVE-2026-7832 |
medium | 6.4 | 0.0013 | 2026-05-05 | A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of | |
CVE-2026-40354 |
medium | 6.3 | 0.0013 | 2026-04-11 | Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash an | |
CVE-2026-13748 |
medium | 6.3 | 0.0019 | 2026-06-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitra | |
CVE-2026-115424 |
medium | 5.5 | 0.0016 | 2026-10-22 | A flaw was found in the OpenShift client oc. When extracting container image layers with oc image ex | |
CVE-2026-29203 |
medium | 5.3 | 0.0049 | 2026-05-08 | A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting | |
CVE-2026-55686 |
medium | 5.3 | 0.0040 | 2026-06-26 | Podman is a tool for managing OCI containers and pods. From 3.0.0 until 5.7.1, running a malicious c | |
CVE-2026-35372 |
medium | 5.0 | 0.0014 | 2026-04-22 | A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic lin | |
CVE-2026-14699 |
medium | 4.8 | 0.0017 | 2026-07-05 | A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0. The affected element is the | |
CVE-2026-65010 |
medium | 4.4 | 0.0017 | 2026-07-23 | Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extrac | |
CVE-2026-106566 |
medium | 4.4 | 0.0014 | 2026-10-07 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior | |
CVE-2026-13218 |
medium | 4.2 | 0.0014 | 2026-06-26 | A flaw was found in KubeVirt's virt-handler network cache handling. The WriteToCachedFile function w | |
CVE-2026-41579 |
low | 3.3 | 0.0019 | 2026-07-01 | runc is a CLI tool for spawning and running containers according to the OCI specification. In versio | |
CVE-2026-17459 |
low | 2.1 | 0.0047 | 2026-07-26 | A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the functi | |
CVE-2026-8784 |
low | 1.8 | 0.0016 | 2026-05-18 | A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function change_file_ | |
CVE-2026-54420 |
— | — | 0.0144 | — | LiteSpeed cPanel plugin contains a UNIX symbolic link (Symlink) following vulnerability that could a | KEV |