Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-67427 |
high | 8.6 | 0.0045 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf | |
CVE-2026-48546 |
high | 8.5 | 0.0049 | 2026-06-11 | KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute ar | |
CVE-2026-61437 |
high | 8.5 | 0.0020 | 2026-07-10 | PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vuln | |
CVE-2026-65327 |
high | 8.4 | 0.0025 | 2026-10-26 | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, mac | |
CVE-2026-48033 |
high | 8.4 | 0.0048 | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp | |
CVE-2026-7963 |
high | 8.3 | 0.0022 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remo | |
CVE-2026-8571 |
high | 8.3 | 0.0021 | 2026-05-14 | Insufficient policy enforcement in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a | |
CVE-2026-12031 |
high | 8.3 | 0.0019 | 2026-06-11 | Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a | |
CVE-2026-12438 |
high | 8.3 | 0.0021 | 2026-06-17 | Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed | |
CVE-2026-13951 |
high | 8.3 | 0.0030 | 2026-06-30 | Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote atta | |
CVE-2026-14151 |
high | 8.3 | 0.0033 | 2026-06-30 | Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker | |
CVE-2026-19152 |
high | 8.3 | 0.0030 | 2026-08-06 | Insufficient policy enforcement in Navigation in Google Chrome prior to 151.0.7922.109 allowed a rem | |
CVE-2026-45733 |
high | 8.3 | 0.0043 | 2026-08-18 | Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe | |
CVE-2026-109782 |
high | 8.3 | 0.0027 | 2026-10-13 | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 | |
CVE-2026-109783 |
high | 8.3 | 0.0027 | 2026-10-13 | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 | |
CVE-2026-40604 |
high | 8.2 | 0.0010 | 2026-04-21 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. | |
CVE-2026-7978 |
high | 8.1 | 0.0024 | 2026-05-06 | Inappropriate implementation in Companion in Google Chrome on Mac prior to 148.0.7778.96 allowed a r | |
CVE-2026-8018 |
high | 8.1 | 0.0026 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote | |
CVE-2026-50646 |
high | 7.8 | 0.0402 | 2026-07-14 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local | |
CVE-2026-54981 |
high | 7.8 | 0.0047 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension al | |
CVE-2026-47305 |
high | 7.8 | 0.0047 | 2026-07-14 | Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall | |
CVE-2026-69278 |
high | 7.8 | 0.0032 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security f | |
CVE-2026-40158 |
high | 7.8 | 0.0024 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI's AST-based Python sandbox can | |
CVE-2026-7913 |
high | 7.8 | 0.0011 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 148.0.7778.96 allow | |
CVE-2026-28912 |
high | 7.8 | 0.0017 | 2026-07-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, | |
CVE-2026-56838 |
high | 7.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI rec | |
CVE-2026-46634 |
high | 7.7 | 0.0062 | 2026-07-14 | Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inn | |
CVE-2026-14440 |
high | 7.6 | 0.0020 | 2026-07-01 | Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal | |
CVE-2024-6832 |
high | 7.5 | 0.0041 | 2026-08-06 | The account locking mechanism fails to trigger when secondary user stores are inaccessible. The soft | |
CVE-2026-22753 |
high | 7.5 | 0.0025 | 2026-04-22 | Vulnerability in Spring Spring Security. If an application is using securityMatchers(String) and a P | |
CVE-2026-43660 |
high | 7.5 | 0.0027 | 2026-05-11 | A validation issue was addressed with improved logic. This issue is fixed in Safari 26.5, iOS 18.7.9 | |
CVE-2026-8585 |
high | 7.5 | 0.0018 | 2026-05-14 | Inappropriate implementation in Media in Google Chrome on iOS prior to 148.0.7778.168 allowed a remo | |
CVE-2026-14409 |
high | 7.5 | 0.0036 | 2026-07-01 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker | |
CVE-2026-39420 |
high | 7.4 | 0.0049 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an incomplete sand | |
CVE-2026-39421 |
high | 7.4 | 0.0026 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a sandbox esca | |
CVE-2025-10528 |
high | 7.3 | 0.0037 | 2025-09-16 | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This | |
CVE-2026-44000 |
high | 7.2 | 0.0020 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 a | |
CVE-2026-44982 |
high | 7.2 | 0.0037 | 2026-07-16 | CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/re | |
CVE-2026-42261 |
high | 7.1 | 0.0024 | 2026-05-08 | PromptHub is an all-in-one AI toolbox for prompt, skill, and agent management. From version 0.4.9 to | |
CVE-2026-59207 |
high | 7.1 | 0.0045 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents featur | |
CVE-2026-46639 |
high | 7.1 | 0.0039 | 2026-07-14 | Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compi | |
CVE-2026-48806 |
high | 7.1 | 0.0042 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping | |
CVE-2026-48807 |
high | 7.1 | 0.0037 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully c | |
CVE-2026-60086 |
medium | 6.9 | 0.0027 | 2026-07-10 | PraisonAI before 4.6.78 contains a prompt injection defense bypass vulnerability where the injection | |
CVE-2026-52873 |
medium | 6.9 | 0.0036 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. From versi | |
CVE-2026-22692 |
medium | 6.8 | 0.0040 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions | |
CVE-2026-17919 |
medium | 6.8 | 0.0016 | 2026-07-30 | Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed | |
CVE-2026-76827 |
medium | 6.8 | 0.0053 | 2026-08-19 | A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed | |
CVE-2026-62902 |
medium | 6.5 | 0.0087 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to | |
CVE-2026-110181 |
medium | 6.5 | 0.0027 | 2026-10-28 | PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL- |