Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (542)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-67429 |
critical | 10.0 | 0.0057 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.dow | |
CVE-2026-40342 |
critical | 9.9 | 0.0069 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 | |
CVE-2026-115931 |
critical | 9.9 | 0.0049 | 2026-10-23 | Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. T | |
CVE-2026-52680 |
critical | 9.8 | 0.0111 | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when | |
CVE-2026-66302 |
critical | 9.8 | 0.0097 | 2026-09-08 | External control of file name or path in Skype for Business allows an unauthorized attacker to execu | |
CVE-2026-46652 |
critical | 9.8 | 0.0070 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2024-8517 |
critical | 9.8 | 0.9461 | 2024-09-06 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and una | 2 PoC |
CVE-2026-8043 |
critical | 9.6 | 0.0087 | 2026-05-12 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authentica | |
CVE-2025-71334 |
critical | 9.3 | 0.0436 | 2026-06-25 | Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that | |
CVE-2026-13014 |
critical | 9.2 | 0.0070 | 2026-07-13 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated | |
CVE-2026-61462 |
critical | 9.2 | 0.0048 | 2026-07-13 | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that al | |
CVE-2026-72742 |
critical | 9.2 | 0.0051 | 2026-08-11 | DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters | |
CVE-2026-48162 |
critical | 9.1 | 0.0065 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-49441 |
critical | 9.1 | 0.0077 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-16926 |
critical | 9.1 | 0.0056 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary f | |
CVE-2026-59807 |
high | 8.9 | 0.0037 | 2026-07-08 | Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows atta | |
CVE-2026-55002 |
high | 8.8 | 0.0091 | 2026-07-14 | External control of file name or path in SQL Server allows an authorized attacker to elevate privile | |
CVE-2026-40370 |
high | 8.8 | 0.0056 | 2026-05-12 | External control of file name or path in SQL Server allows an authorized attacker to execute code ov | |
CVE-2026-53915 |
high | 8.8 | 0.0045 | 2026-06-19 | In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configu | |
CVE-2026-48720 |
high | 8.8 | 0.0044 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15. | |
CVE-2026-59793 |
high | 8.8 | 0.0049 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integr | |
CVE-2026-14551 |
high | 8.8 | 0.0014 | 2026-07-22 | The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20. | |
CVE-2026-60009 |
high | 8.8 | 0.0044 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f | |
CVE-2026-65941 |
high | 8.8 | 0.0068 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network a | |
CVE-2026-67920 |
high | 8.8 | 0.0094 | 2026-08-18 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migr | |
CVE-2026-52872 |
high | 8.8 | 0.0018 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2 | |
CVE-2026-15724 |
high | 8.7 | 0.0052 | 2026-07-21 | In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated | |
CVE-2026-15307 |
high | 8.7 | 0.0113 | 2026-08-04 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups | |
CVE-2026-23898 |
high | 8.6 | 0.0046 | 2026-04-01 | Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server | |
CVE-2026-90932 |
high | 8.6 | 0.0082 | 2026-09-14 | LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrad | 1 PoC |
CVE-2026-43989 |
high | 8.5 | 0.0015 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm | |
CVE-2026-8921 |
high | 8.5 | 0.0015 | 2026-07-03 | External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to | |
CVE-2026-8920 |
high | 8.5 | 0.0011 | 2026-07-15 | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Nam | |
CVE-2026-75913 |
high | 8.5 | 0.0048 | 2026-08-18 | CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm a | |
CVE-2026-42881 |
high | 8.4 | 0.0023 | 2026-05-14 | STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an at | |
CVE-2026-12070 |
high | 8.4 | 0.0040 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability | |
CVE-2026-54200 |
high | 8.4 | 0.0040 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in | |
CVE-2026-46345 |
high | 8.4 | 0.0020 | 2026-08-17 | compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 a | |
CVE-2026-52875 |
high | 8.4 | 0.0016 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2 | |
CVE-2026-31939 |
high | 8.3 | 0.0035 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exe | |
CVE-2026-15736 |
high | 8.3 | 0.0038 | 2026-07-14 | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: I | |
CVE-2026-45089 |
high | 8.2 | 0.0024 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe | |
CVE-2026-5821 |
high | 8.1 | 0.0076 | 2026-07-02 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to | |
CVE-2026-92709 |
high | 8.1 | 0.0030 | 2026-10-22 | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfi | |
CVE-2026-58293 |
high | 8.1 | 0.0061 | 2026-07-03 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized atta | |
CVE-2026-34783 |
high | 8.1 | 0.0051 | 2026-04-06 | Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal v | |
CVE-2026-46402 |
high | 8.1 | 0.0075 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-44019 |
high | 8.1 | 0.0042 | 2026-07-16 | Docling Core defines core data types and transformations for the document processing application Doc | |
CVE-2026-77176 |
high | 8.1 | 0.0048 | 2026-08-20 | A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containe | |
CVE-2026-57113 |
high | 8.1 | 0.0040 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's te |