Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-34208 |
critical | 10.0 | 0.0056 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to | |
CVE-2026-26332 |
critical | 10.0 | 0.0071 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attack | |
CVE-2026-41900 |
critical | 10.0 | 0.0091 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3 | |
CVE-2026-47140 |
critical | 10.0 | 0.0098 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangero | |
CVE-2026-47686 |
critical | 9.9 | 0.0058 | 2026-08-17 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbo | |
CVE-2026-76301 |
critical | 9.8 | 0.0038 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted | |
CVE-2026-34072 |
critical | 9.8 | 0.0044 | 2026-04-01 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log | |
CVE-2026-14535 |
critical | 9.8 | 0.0056 | 2026-07-04 | In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unc | |
CVE-2026-16356 |
critical | 9.8 | 0.0058 | 2026-07-21 | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was | |
CVE-2026-16377 |
critical | 9.8 | 0.0057 | 2026-07-21 | Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox | |
CVE-2026-16382 |
critical | 9.8 | 0.0056 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 | |
CVE-2026-16383 |
critical | 9.8 | 0.0057 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Fir | |
CVE-2026-16388 |
critical | 9.8 | 0.0055 | 2026-07-21 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thu | |
CVE-2026-16407 |
critical | 9.8 | 0.0051 | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 | |
CVE-2026-109780 |
critical | 9.8 | 0.0036 | 2026-10-13 | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and | |
CVE-2026-12027 |
critical | 9.6 | 0.0022 | 2026-06-11 | Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote a | |
CVE-2026-13859 |
critical | 9.6 | 0.0038 | 2026-06-30 | Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attac | |
CVE-2026-13909 |
critical | 9.6 | 0.0034 | 2026-06-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote | |
CVE-2026-14017 |
critical | 9.6 | 0.0034 | 2026-06-30 | Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote | |
CVE-2026-14037 |
critical | 9.6 | 0.0034 | 2026-06-30 | Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote atta | |
CVE-2026-14097 |
critical | 9.6 | 0.0032 | 2026-06-30 | Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowe | |
CVE-2026-14101 |
critical | 9.6 | 0.0033 | 2026-06-30 | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a | |
CVE-2026-14120 |
critical | 9.6 | 0.0034 | 2026-06-30 | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at | |
CVE-2026-17669 |
critical | 9.6 | 0.0034 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowe | |
CVE-2026-17676 |
critical | 9.6 | 0.0049 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a r | |
CVE-2026-17695 |
critical | 9.6 | 0.0048 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remot | |
CVE-2026-17710 |
critical | 9.6 | 0.0034 | 2026-07-30 | Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remot | |
CVE-2026-17856 |
critical | 9.6 | 0.0034 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a rem | |
CVE-2026-17865 |
critical | 9.6 | 0.0034 | 2026-07-30 | Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remo | |
CVE-2026-18015 |
critical | 9.6 | 0.0034 | 2026-07-30 | Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote | |
CVE-2026-114139 |
critical | 9.1 | 0.0051 | 2026-10-21 | Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and | |
CVE-2026-12315 |
critical | 9.1 | 0.0025 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firef | |
CVE-2026-12316 |
critical | 9.1 | 0.0024 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Th | |
CVE-2026-16370 |
critical | 9.1 | 0.0043 | 2026-07-21 | Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and | |
CVE-2026-16380 |
critical | 9.1 | 0.0043 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thund | |
CVE-2026-16390 |
critical | 9.1 | 0.0044 | 2026-07-21 | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, | |
CVE-2026-16394 |
critical | 9.1 | 0.0043 | 2026-07-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Th | |
CVE-2026-16406 |
critical | 9.1 | 0.0043 | 2026-07-21 | Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thund | |
CVE-2026-57144 |
high | 8.8 | 0.0012 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sa | |
CVE-2026-57280 |
high | 8.8 | 0.0051 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not intercept the implicit type c | |
CVE-2026-17677 |
high | 8.8 | 0.0048 | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a r | |
CVE-2026-17899 |
high | 8.8 | 0.0026 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attac | |
CVE-2026-19150 |
high | 8.8 | 0.0041 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacke | |
CVE-2026-19168 |
high | 8.8 | 0.0041 | 2026-08-06 | Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacke | |
CVE-2026-45227 |
high | 8.7 | 0.0029 | 2026-05-12 | Heym before 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor that a | |
CVE-2026-47135 |
high | 8.7 | 0.0027 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup- | |
CVE-2026-72781 |
high | 8.7 | 0.0079 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code e | |
CVE-2026-47139 |
high | 8.6 | 0.0036 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding pub | |
CVE-2026-47209 |
high | 8.6 | 0.0029 | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in b | |
CVE-2026-48721 |
high | 8.6 | 0.0022 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15. |