Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65899 |
medium | 5.1 | 0.0041 | 2026-07-23 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is | |
CVE-2026-8009 |
medium | 5.0 | 0.0012 | 2026-05-06 | Inappropriate implementation in Cast in Google Chrome prior to 148.0.7778.96 allowed a remote attack | |
CVE-2026-65339 |
medium | 5.0 | 0.0015 | 2026-08-17 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.11 and iPadOS 18.7 | |
CVE-2026-59854 |
medium | 4.9 | 0.0049 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, POST /api/file/global | |
CVE-2026-7932 |
medium | 4.4 | 0.0012 | 2026-05-06 | Insufficient policy enforcement in Downloads in Google Chrome prior to 148.0.7778.96 allowed a local | |
CVE-2026-48792 |
medium | 4.4 | 0.0013 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, s | |
CVE-2026-110182 |
medium | 4.3 | 0.0018 | 2026-10-28 | PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email( | |
CVE-2026-32202 |
medium | 4.3 | 0.7090 | 2026-04-14 | Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unautho | KEV |
CVE-2026-7946 |
medium | 4.3 | 0.0020 | 2026-05-06 | Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to | |
CVE-2026-8004 |
medium | 4.3 | 0.0013 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attac | |
CVE-2026-8011 |
medium | 4.3 | 0.0016 | 2026-05-06 | Insufficient policy enforcement in Search in Google Chrome prior to 148.0.7778.96 allowed a remote a | |
CVE-2026-8014 |
medium | 4.3 | 0.0016 | 2026-05-06 | Inappropriate implementation in Preload in Google Chrome prior to 148.0.7778.96 allowed a remote att | |
CVE-2026-30904 |
medium | 4.3 | 0.0014 | 2026-05-13 | Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticat | |
CVE-2026-8563 |
medium | 4.3 | 0.0018 | 2026-05-14 | Insufficient policy enforcement in IFrame Sandbox in Google Chrome on Windows prior to 148.0.7778.16 | |
CVE-2026-14058 |
medium | 4.3 | 0.0025 | 2026-06-30 | Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
CVE-2026-14076 |
medium | 4.3 | 0.0023 | 2026-06-30 | Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote | |
CVE-2026-14092 |
medium | 4.3 | 0.0018 | 2026-06-30 | Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attack | |
CVE-2026-56585 |
medium | 4.3 | 0.0025 | 2026-07-21 | HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attacker | |
CVE-2026-17943 |
medium | 4.3 | 0.0025 | 2026-07-30 | Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote atta | |
CVE-2026-70444 |
medium | 4.3 | 0.0029 | 2026-08-05 | A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows | |
CVE-2026-111965 |
medium | 4.3 | 0.0026 | 2026-10-23 | The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification | |
CVE-2026-7952 |
medium | 4.2 | 0.0017 | 2026-05-06 | Insufficient policy enforcement in Extensions in Google Chrome prior to 148.0.7778.96 allowed a remo | |
CVE-2026-12457 |
medium | 4.2 | 0.0014 | 2026-06-17 | Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed a remote | |
CVE-2026-17659 |
medium | 4.2 | 0.0021 | 2026-07-30 | Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remo | |
CVE-2026-87100 |
low | 3.6 | 0.0010 | 2026-10-28 | Protection mechanism failure due to missing binary hardening in Linux executables. The following pro | |
CVE-2026-114614 |
low | 3.5 | 0.0018 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, au | |
CVE-2026-39419 |
low | 3.1 | 0.0022 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated u | |
CVE-2026-7909 |
low | 3.1 | 0.0019 | 2026-05-06 | Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remo | |
CVE-2026-7937 |
low | 3.1 | 0.0014 | 2026-05-06 | Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attac | |
CVE-2026-7959 |
low | 3.1 | 0.0019 | 2026-05-06 | Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote | |
CVE-2026-8572 |
low | 3.1 | 0.0016 | 2026-05-14 | Insufficient policy enforcement in Network in Google Chrome on Android prior to 148.0.7778.168 allow | |
CVE-2026-60164 |
low | 3.1 | 0.0027 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Ora | |
CVE-2026-60166 |
low | 3.1 | 0.0027 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Ora | |
CVE-2026-91402 |
low | 3.1 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Ora | |
CVE-2026-14625 |
low | 2.1 | 0.0038 | 2026-07-04 | A security flaw has been discovered in NousResearch hermes-agent up to 0.15.2. The affected element | |
CVE-2026-15618 |
low | 2.1 | 0.0042 | 2026-07-14 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the fun | |
CVE-2026-15528 |
low | 1.9 | 0.0016 | 2026-07-13 | A vulnerability was found in lamaalrajih kicad-mcp up to 3.3.1. This issue affects some unknown proc | |
CVE-2026-116145 |
low | 1.8 | 0.0011 | 2026-10-25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an | |
CVE-2013-0431 |
— | — | 0.9015 | — | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote at | KEV |
CVE-2024-21412 |
— | — | 0.9941 | — | Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a se | KEV |
CVE-2024-38217 |
— | — | 0.1003 | — | Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that | KEV |
CVE-2024-38226 |
— | — | 0.0267 | — | Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to by | KEV |
CVE-2026-41316 |
— | — | 0.0113 | 2026-04-24 | ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) int | |
CVE-2026-24118 |
— | — | 0.0091 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox br | |
CVE-2026-24120 |
— | — | 0.0090 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is | |
CVE-2026-24781 |
— | — | 0.0119 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox br | |
CVE-2026-26956 |
— | — | 0.0109 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox e | |
CVE-2026-8401 |
— | — | 0.0031 | 2026-05-12 | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Fir | |
CVE-2026-12294 |
— | — | 0.0036 | 2026-06-16 | Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox E | |
CVE-2026-12295 |
— | — | 0.0039 | 2026-06-16 | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefo |