Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2660)
CWE-79 (1932)
CWE-416 (1558)
CWE-862 (1259)
CWE-122 (1130)
CWE-89 (1124)
CWE-125 (1089)
CWE-22 (1052)
CWE-306 (873)
CWE-200 (871)
CWE-20 (832)
CWE-787 (739)
CWE-78 (729)
CWE-918 (712)
CWE-863 (674)
CWE-94 (661)
CWE-74 (605)
CWE-639 (583)
CWE-400 (547)
CWE-269 (512)
CWE-119 (507)
CWE-502 (494)
CWE-287 (456)
CWE-770 (453)
CWE-121 (446)
CWE-190 (420)
CWE-362 (394)
CWE-77 (384)
CWE-476 (322)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54623 |
high | 7.1 | 0.0049 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-116586 |
medium | 6.9 | 0.0029 | 2026-10-26 | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards | |
CVE-2026-34211 |
medium | 6.9 | 0.0040 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains | |
CVE-2026-17501 |
medium | 6.9 | 0.0072 | 2026-07-27 | A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transfo | |
CVE-2026-15830 |
medium | 6.9 | 0.0111 | 2026-08-04 | An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contri | |
CVE-2026-119137 |
medium | 6.9 | 0.0040 | 2026-10-29 | Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that | |
CVE-2026-47770 |
medium | 6.8 | 0.0015 | 2026-06-25 | jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays | |
CVE-2026-110259 |
medium | 6.8 | 0.0017 | 2026-10-14 | OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmIn | |
CVE-2026-119371 |
medium | 6.8 | — | 2026-10-30 | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the S | |
CVE-2026-119376 |
medium | 6.8 | — | 2026-10-30 | SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the S | |
CVE-2026-119591 |
medium | 6.8 | — | 2026-10-30 | SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that all | |
CVE-2026-15996 |
medium | 6.6 | 0.0077 | 2026-08-05 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthe | |
CVE-2026-88858 |
medium | 6.5 | 0.0034 | 2026-10-28 | A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math | |
CVE-2026-24401 |
medium | 6.5 | 0.0037 | 2026-01-24 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protoco | |
CVE-2026-56148 |
medium | 6.5 | 0.0047 | 2026-07-01 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allo | |
CVE-2026-14803 |
medium | 6.5 | 0.0053 | 2026-07-06 | Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure | |
CVE-2026-63144 |
medium | 6.5 | 0.0042 | 2026-07-21 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially craf | |
CVE-2026-16192 |
medium | 6.5 | 0.0037 | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of serv | |
CVE-2026-55862 |
medium | 6.5 | 0.0046 | 2026-10-16 | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multi | |
CVE-2026-110974 |
medium | 6.3 | 0.0033 | 2026-10-22 | The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with | |
CVE-2026-119123 |
medium | 6.3 | 0.0030 | 2026-10-29 | ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs | |
CVE-2026-61846 |
medium | 6.3 | — | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior t | |
CVE-2026-61847 |
medium | 6.3 | — | 2026-10-30 | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior t | |
CVE-2026-42328 |
medium | 6.2 | 0.0012 | 2026-05-27 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batte | |
CVE-2026-92822 |
medium | 6.2 | 0.0021 | 2026-10-21 | A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into neste | |
CVE-2026-1681 |
medium | 6.1 | 0.0014 | 2026-05-12 | Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the netw | |
CVE-2026-6811 |
medium | 6.0 | 0.0037 | 2026-05-14 | Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processi | |
CVE-2026-66282 |
medium | 6.0 | 0.0033 | 2026-10-22 | In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive | |
CVE-2025-71393 |
medium | 6.0 | 0.0046 | 2026-07-18 | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native | |
CVE-2026-65628 |
medium | 5.9 | 0.0014 | 2026-10-26 | jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secr | |
CVE-2026-62303 |
medium | 5.9 | — | 2026-10-30 | Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeN | |
CVE-2026-16440 |
medium | 5.7 | 0.0030 | 2026-08-19 | In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a | |
CVE-2026-14255 |
medium | 5.5 | 0.0016 | 2026-09-02 | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncont | |
CVE-2026-33947 |
medium | 5.5 | 0.0023 | 2026-04-13 | jq is a command-line JSON processor. In versions 1.8.1 and below, functions jv_setpath(), jv_getpath | |
CVE-2026-6862 |
medium | 5.5 | 0.0012 | 2026-04-22 | A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fai | |
CVE-2026-5299 |
medium | 5.5 | 0.0012 | 2026-04-30 | ICMPv6 PvD protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of | |
CVE-2026-43896 |
medium | 5.5 | 0.0015 | 2026-05-11 | jq is a command-line JSON processor. In 1.8.1 and earlier, unbounded recursion in jv_object_merge_re | |
CVE-2026-42355 |
medium | 5.5 | 0.0015 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recurs | |
CVE-2026-42445 |
medium | 5.5 | 0.0011 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recurs | |
CVE-2023-52761 |
medium | 5.5 | 0.0027 | 2024-05-21 | In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow dete | |
CVE-2024-53090 |
medium | 5.5 | 0.0066 | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix lock recursion afs_wa | |
CVE-2026-40612 |
medium | 5.4 | 0.0016 | 2026-05-11 | jq is a command-line JSON processor. In 1.8.1 and earlier, jv_contains recurses into nested arrays/o | |
CVE-2026-44777 |
medium | 5.4 | 0.0016 | 2026-05-11 | jq is a command-line JSON processor. In 1.8.2rc1 and earlier, the ordinary module loader recurses wi | |
CVE-2026-113650 |
medium | 5.3 | 0.0048 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an | |
CVE-2026-45205 |
medium | 5.3 | 0.0047 | 2026-05-14 | Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration | |
CVE-2026-54269 |
medium | 5.3 | 0.0040 | 2026-06-22 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, p | |
CVE-2026-59927 |
medium | 5.3 | 0.0053 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directiv | |
CVE-2026-46714 |
medium | 5.1 | 0.0044 | 2026-08-03 | Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to | |
CVE-2026-116144 |
medium | 4.8 | 0.0012 | 2026-10-25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG deco | |
CVE-2026-119542 |
medium | 4.3 | — | 2026-10-30 | A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicate |