Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2660)
CWE-79 (1932)
CWE-416 (1558)
CWE-862 (1259)
CWE-122 (1130)
CWE-89 (1124)
CWE-125 (1089)
CWE-22 (1052)
CWE-306 (873)
CWE-200 (871)
CWE-20 (832)
CWE-787 (739)
CWE-78 (729)
CWE-918 (712)
CWE-863 (674)
CWE-94 (660)
CWE-74 (605)
CWE-639 (583)
CWE-400 (547)
CWE-269 (512)
CWE-119 (507)
CWE-502 (494)
CWE-287 (456)
CWE-770 (453)
CWE-121 (446)
CWE-190 (420)
CWE-362 (394)
CWE-77 (384)
CWE-476 (322)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-43185 |
critical | 9.8 | 0.0083 | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in | |
CVE-2026-40324 |
critical | 9.1 | 0.0090 | 2026-04-18 | Hot Chocolate is an open-source GraphQL server. Prior to versions 12.22.7, 13.9.16, 14.3.1, and 15.1 | |
CVE-2026-32327 |
critical | 9.1 | 0.0046 | 2026-08-06 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library co | |
CVE-2026-103600 |
high | 8.7 | 0.0036 | 2026-10-02 | Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Boun | |
CVE-2026-112895 |
high | 8.7 | 0.0059 | 2026-10-19 | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while pars | |
CVE-2026-116871 |
high | 8.7 | 0.0037 | 2026-10-27 | Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyPars | |
CVE-2026-41680 |
high | 8.7 | 0.0034 | 2026-04-24 | Marked is a markdown parser and compiler. From 18.0.0 to 18.0.1, a critical Denial of Service (DoS) | |
CVE-2026-41636 |
high | 8.7 | 0.0045 | 2026-04-28 | Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Th | |
CVE-2026-15957 |
high | 8.7 | 0.0041 | 2026-07-21 | Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers fr | |
CVE-2026-58227 |
high | 8.7 | 0.0039 | 2026-07-27 | The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certifi | |
CVE-2026-67215 |
high | 8.7 | 0.0070 | 2026-07-29 | cJSON through 1.7.19 is vulnerable to uncontrolled recursion leading to stack exhaustion when an unt | |
CVE-2026-18140 |
high | 8.7 | 0.0078 | 2026-07-30 | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62 | |
CVE-2026-69220 |
high | 8.7 | 0.0073 | 2026-08-18 | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact w | |
CVE-2026-116011 |
high | 8.7 | 0.0068 | 2026-10-24 | Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows | |
CVE-2026-119762 |
high | 8.7 | — | 2026-10-30 | Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unaut | |
CVE-2026-66920 |
high | 8.2 | 0.0043 | 2026-07-28 | Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and | |
CVE-2026-53267 |
high | 7.8 | 0.0012 | 2026-06-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: bail out on | |
CVE-2026-17121 |
high | 7.5 | 0.0055 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-114605 |
high | 7.5 | 0.0034 | 2026-10-22 | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-co | |
CVE-2026-118035 |
high | 7.5 | 0.0029 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recur | |
CVE-2026-118036 |
high | 7.5 | 0.0037 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recur | |
CVE-2026-118037 |
high | 7.5 | 0.0027 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recur | |
CVE-2026-58280 |
high | 7.5 | 0.0125 | 2026-10-13 | Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | |
CVE-2026-40879 |
high | 7.5 | 0.0033 | 2026-04-21 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when a | |
CVE-2026-44028 |
high | 7.5 | 0.0018 | 2026-05-05 | An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR ( | |
CVE-2026-4870 |
high | 7.5 | 0.0027 | 2026-06-12 | IBM Qiskit SDK 0.43.0 through 2.5.0 could allow an attacker to trigger a segmentation fault leading | |
CVE-2026-48712 |
high | 7.5 | 0.0046 | 2026-06-22 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, p | |
CVE-2026-57081 |
high | 7.5 | 0.0049 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested ben | |
CVE-2026-49451 |
high | 7.5 | 0.0075 | 2026-06-30 | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common s | |
CVE-2026-40007 |
high | 7.5 | 0.0049 | 2026-07-10 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_a | |
CVE-2026-64194 |
high | 7.5 | 0.0068 | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer cha | |
CVE-2026-66274 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially | |
CVE-2026-67552 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially | |
CVE-2026-67590 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially | |
CVE-2026-68073 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially | |
CVE-2026-61483 |
high | 7.5 | 0.0103 | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue a | |
CVE-2026-73566 |
high | 7.5 | 0.0053 | 2026-08-13 | node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter | |
CVE-2026-91765 |
high | 7.5 | 0.0038 | 2026-09-25 | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. A | |
CVE-2026-54425 |
high | 7.5 | 0.0026 | 2026-10-21 | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attack | |
CVE-2026-54426 |
high | 7.5 | 0.0016 | 2026-10-21 | Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis serve | |
CVE-2026-54427 |
high | 7.5 | 0.0016 | 2026-10-21 | Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash | |
CVE-2026-82230 |
high | 7.5 | 0.0055 | 2026-10-21 | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms | |
CVE-2026-110673 |
high | 7.5 | 0.0049 | 2026-10-19 | Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under | |
CVE-2026-119187 |
high | 7.5 | 0.0041 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2026-119191 |
high | 7.5 | 0.0043 | 2026-10-29 | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. | |
CVE-2026-92391 |
high | 7.5 | 0.0036 | 2026-10-20 | A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in l | |
CVE-2026-106972 |
high | 7.5 | 0.0015 | 2026-10-28 | Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to | |
CVE-2026-69378 |
high | 7.5 | 0.0117 | 2026-09-08 | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service | |
CVE-2024-58370 |
high | 7.1 | 0.0049 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL | |
CVE-2026-41935 |
high | 7.1 | 0.0027 | 2026-05-14 | Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispat |