Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-18697 |
high | 8.7 | 0.0044 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an unauthenticated party to cause a m | |
CVE-2026-63388 |
high | 8.4 | 0.0014 | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out- | |
CVE-2026-66754 |
high | 8.2 | 0.0056 | 2026-07-28 | Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_pref | |
CVE-2026-34063 |
high | 7.5 | 0.0035 | 2026-04-22 | Nimiq's network-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `n | |
CVE-2026-12413 |
high | 7.5 | 0.0060 | 2026-07-02 | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Contin | |
CVE-2026-44435 |
high | 7.5 | 0.0049 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server | |
CVE-2026-12617 |
high | 7.5 | 0.0052 | 2026-07-22 | The issue is unexpected program termination based on ordering and/or specific content in responses t | |
CVE-2026-13204 |
high | 7.5 | 0.0052 | 2026-07-22 | If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there e | |
CVE-2026-45815 |
high | 7.5 | 0.0103 | 2026-07-24 | Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable R | |
CVE-2026-52856 |
high | 7.5 | 0.0061 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. | |
CVE-2026-52829 |
high | 7.5 | 0.0061 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can det | |
CVE-2026-76163 |
high | 7.5 | 0.0057 | 2026-09-16 | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker | |
CVE-2026-80274 |
high | 7.5 | 0.0057 | 2026-09-16 | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative serve | |
CVE-2026-96888 |
high | 7.5 | 0.0046 | 2026-10-21 | A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may a | |
CVE-2026-97313 |
high | 7.5 | 0.0045 | 2026-10-21 | A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recurs | |
CVE-2026-102483 |
high | 7.5 | 0.0043 | 2026-10-21 | Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon v | |
CVE-2026-76491 |
high | 7.5 | 0.0036 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expresswa | |
CVE-2026-8843 |
high | 7.1 | 0.0024 | 2026-05-18 | Creating a "2dsphere_bucket" index on a non-timeseries bucket collection will succeed, but any subse | |
CVE-2026-47145 |
high | 7.1 | 0.0044 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate | |
CVE-2026-47146 |
high | 7.1 | 0.0044 | 2026-06-25 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate | |
CVE-2026-55514 |
high | 7.1 | 0.0066 | 2026-07-06 | vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt | |
CVE-2026-13055 |
high | 7.1 | 0.0040 | 2026-07-22 | The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a Mon | |
CVE-2026-13058 |
high | 7.1 | 0.0040 | 2026-07-22 | An authenticated user with basic write privileges can cause the mongod process to terminate abnormal | |
CVE-2026-9737 |
high | 7.1 | 0.0042 | 2026-07-22 | During query planning when reading the sort pattern in raw BSONObj form, in some places we don’t exp | |
CVE-2026-18695 |
high | 7.1 | 0.0040 | 2026-08-11 | An issue in MongoDB Server's handling of certain query predicates against time-series collections wi | |
CVE-2026-109944 |
high | 7.1 | 0.0029 | 2026-10-13 | FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a | |
CVE-2026-81038 |
high | 7.1 | 0.0015 | 2026-10-26 | The Object Transfer Service server builds its Object Action Control Point (OACP) response indication | |
CVE-2026-116467 |
medium | 6.9 | 0.0064 | 2026-10-26 | A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerabilit | |
CVE-2026-9718 |
medium | 6.9 | 0.0043 | 2026-06-25 | CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigg | |
CVE-2026-115914 |
medium | 6.5 | 0.0039 | 2026-10-26 | vLLM is an inference and serving engine for large language models. From 0.11.1 until 0.32.0, the Dee | |
CVE-2026-30867 |
medium | 6.5 | 0.0032 | 2026-04-02 | CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a | |
CVE-2026-34067 |
medium | 6.5 | 0.0032 | 2026-04-22 | nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prio | |
CVE-2026-20450 |
medium | 6.5 | 0.0029 | 2026-05-04 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remot | |
CVE-2026-10651 |
medium | 6.5 | 0.0030 | 2026-06-23 | bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record b | |
CVE-2026-63140 |
medium | 6.5 | 0.0042 | 2026-07-21 | Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipula | |
CVE-2026-10822 |
medium | 6.5 | 0.0038 | 2026-07-22 | If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid d | |
CVE-2023-38469 |
medium | 6.2 | 0.0032 | 2023-11-02 | A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_re | |
CVE-2023-38470 |
medium | 6.2 | 0.0032 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() functio | |
CVE-2023-38471 |
medium | 6.2 | 0.0033 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. | |
CVE-2023-38472 |
medium | 6.2 | 0.0032 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function | |
CVE-2023-38473 |
medium | 6.2 | 0.0032 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name( | |
CVE-2026-47475 |
medium | 6.2 | 0.0016 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacke | |
CVE-2026-71430 |
medium | 6.2 | 0.0016 | 2026-08-06 | node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedR | |
CVE-2026-58307 |
medium | 6.1 | 0.0015 | 2026-07-09 | Out-of-bounds read, Reachable assertion vulnerability in Samsung Open Source Escargot allows Overrea | |
CVE-2026-50721 |
medium | 5.9 | 0.0039 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the | |
CVE-2026-50722 |
medium | 5.9 | 0.0035 | 2026-07-02 | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verif | |
CVE-2026-14586 |
medium | 5.9 | 0.0037 | 2026-07-22 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high co | |
CVE-2023-53683 |
medium | 5.5 | 0.0016 | 2025-10-07 | In the Linux kernel, the following vulnerability has been resolved: fs: hfsplus: remove WARN_ON() f | |
CVE-2026-98147 |
medium | 5.5 | 0.0011 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthread_r | |
CVE-2026-10674 |
medium | 5.5 | 0.0014 | 2026-07-21 | The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFI |