Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-55276 |
critical | 9.1 | 0.0061 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles | |
CVE-2026-16392 |
critical | 9.1 | 0.0053 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox | |
CVE-2026-40394 |
high | 7.5 | 0.0024 | 2026-04-12 | Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" d | |
CVE-2026-40396 |
high | 7.5 | 0.0035 | 2026-04-12 | Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after ti | |
CVE-2026-53404 |
high | 7.3 | 0.0065 | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant th | |
CVE-2026-41527 |
medium | 6.9 | 0.0011 | 2026-04-21 | KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra u | |
CVE-2026-7656 |
medium | 6.8 | 0.0033 | 2026-06-29 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, | |
CVE-2026-72703 |
medium | 6.8 | 0.0018 | 2026-08-24 | The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without e | |
CVE-2026-72704 |
medium | 6.8 | 0.0018 | 2026-08-24 | The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive | |
CVE-2026-72705 |
medium | 6.8 | 0.0018 | 2026-08-24 | The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own argum | |
CVE-2026-40942 |
medium | 6.3 | 0.0029 | 2026-04-21 | The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and F | |
CVE-2020-37288 |
medium | 6.3 | — | 2026-10-21 | Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop i | |
CVE-2026-34946 |
medium | 5.9 | 0.0036 | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime's | |
CVE-2026-6608 |
medium | 5.5 | 0.0031 | 2026-04-20 | A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of t | |
CVE-2026-117859 |
medium | 5.4 | — | 2026-10-29 | A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services com | |
CVE-2026-12321 |
medium | 5.4 | 0.0016 | 2026-06-16 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox | |
CVE-2026-56307 |
medium | 5.3 | 0.0028 | 2026-06-20 | Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices en | |
CVE-2026-35343 |
low | 3.3 | 0.0014 | 2026-04-22 | The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newlin | |
CVE-2026-41988 |
low | 2.5 | 0.0018 | 2026-04-23 | uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID ve | |
CVE-2026-73283 |
low | 2.5 | 0.0015 | 2026-08-11 | In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applica |