Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-20160 |
critical | 9.8 | 0.0093 | 2026-04-01 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated | |
CVE-2026-14960 |
critical | 9.8 | 0.0046 | 2026-07-15 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\ | |
CVE-2026-57144 |
high | 8.8 | 0.0021 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sa | |
CVE-2026-39911 |
high | 8.7 | 0.0054 | 2026-04-09 | Hashgraph Guardian through version 3.5.1, fixed in commit 45fbe2f, contains an unsandboxed JavaScrip | |
CVE-2026-59835 |
high | 8.6 | 0.0040 | 2026-07-14 | A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, F | |
CVE-2026-67427 |
high | 8.6 | 0.0045 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf | |
CVE-2026-53657 |
high | 8.2 | 0.0020 | 2026-07-10 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on | |
CVE-2026-54727 |
high | 8.2 | 0.0019 | 2026-07-29 | proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restor | |
CVE-2023-34119 |
high | 7.8 | 0.0019 | 2023-07-11 | Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow | |
CVE-2026-30912 |
high | 7.5 | 0.0045 | 2026-04-18 | In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_ | |
CVE-2026-57231 |
high | 7.5 | 0.0044 | 2026-06-26 | Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image tha | |
CVE-2026-72782 |
high | 7.1 | 0.0039 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment | |
CVE-2026-34217 |
medium | 6.9 | 0.0029 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, a scope modification vulnerability ex | |
CVE-2026-47141 |
medium | 6.9 | 0.0038 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-w | |
CVE-2026-104073 |
medium | 6.9 | 0.0037 | 2026-10-06 | NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allow | |
CVE-2026-54497 |
medium | 6.8 | 0.0033 | 2026-07-17 | view_component is a framework for building reusable, testable, and encapsulated view components in R | |
CVE-2026-34538 |
medium | 6.5 | 0.0069 | 2026-04-09 | Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to | |
CVE-2026-46723 |
medium | 5.9 | 0.0032 | 2026-05-19 | The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and | |
CVE-2026-72764 |
medium | 5.8 | 0.0081 | 2026-08-11 | n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In | |
CVE-2024-0443 |
medium | 5.5 | 0.0025 | 2024-01-11 | A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to | |
CVE-2026-91788 |
medium | 5.5 | 0.0013 | 2026-09-23 | When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute au | |
CVE-2026-115522 |
medium | 5.3 | 0.0038 | 2026-10-28 | Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Ki | |
CVE-2026-14611 |
medium | 5.3 | 0.0043 | 2026-07-03 | A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function i | |
CVE-2026-6830 |
medium | 4.8 | 0.0011 | 2026-04-21 | nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching | |
CVE-2026-32690 |
low | 3.7 | 0.0042 | 2026-04-18 | Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables | |
CVE-2026-34094 |
low | 2.0 | 0.0017 | 2026-05-11 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil | |
CVE-2026-34095 |
none | — | 0.0018 | 2026-05-11 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil | |
CVE-2026-44008 |
— | — | 0.0085 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpecies | |
CVE-2026-44009 |
— | — | 0.0081 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11. | |
CVE-2026-45411 |
— | — | 0.0057 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host except |