Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-50462 |
high | 7.8 | 0.0046 | 2026-07-14 | External control of file name or path in Windows Ancillary Function Driver for WinSock allows an aut | |
CVE-2026-69783 |
high | 7.8 | 0.0063 | 2026-10-13 | External control of file name or path in Windows Update allows an authorized attacker to elevate pri | |
CVE-2026-32204 |
high | 7.8 | 0.0029 | 2026-05-12 | External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevat | |
CVE-2026-30905 |
high | 7.8 | 0.0012 | 2026-05-13 | External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer b | |
CVE-2026-119250 |
high | 7.8 | — | 2026-10-29 | A malicious actor with local access and low privileges could exploit an External Control of File Nam | |
CVE-2026-66310 |
high | 7.7 | 0.0036 | 2026-08-03 | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker | |
CVE-2026-42845 |
high | 7.7 | 0.0074 | 2026-05-11 | The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0 , there is an unau | |
CVE-2026-18127 |
high | 7.7 | 0.0072 | 2026-08-11 | External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows | |
CVE-2026-35465 |
high | 7.5 | 0.0044 | 2026-04-18 | SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle s | |
CVE-2026-43891 |
high | 7.5 | 0.0035 | 2026-05-12 | changedetection.io is a free open source web page change detection tool. Prior to 0.55.1, the vulner | |
CVE-2026-45088 |
high | 7.5 | 0.0031 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe | |
CVE-2026-49145 |
high | 7.5 | 0.0049 | 2026-07-08 | App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. | |
CVE-2026-56452 |
high | 7.5 | 0.0077 | 2026-07-20 | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for | |
CVE-2026-65802 |
high | 7.4 | 0.0092 | 2026-08-03 | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker | |
CVE-2026-41107 |
high | 7.4 | 0.0065 | 2026-05-12 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized atta | |
CVE-2026-10303 |
high | 7.4 | 0.0076 | 2026-06-16 | In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not s | |
CVE-2026-90464 |
high | 7.2 | 0.0036 | 2026-10-27 | An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic comma | |
CVE-2026-55477 |
high | 7.2 | 0.0062 | 2026-06-25 | 3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated admini | |
CVE-2026-61873 |
high | 7.2 | 0.0031 | 2026-07-15 | Grav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.f | |
CVE-2026-93864 |
high | 7.1 | 0.0013 | 2026-10-27 | A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker w | |
CVE-2026-44641 |
high | 7.1 | 0.0043 | 2026-05-15 | Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, | |
CVE-2026-47214 |
high | 7.1 | 0.0037 | 2026-06-26 | Docling simplifies document processing by parsing diverse formats and providing integrations with th | |
CVE-2026-46336 |
high | 7.1 | 0.0039 | 2026-07-16 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, part | |
CVE-2026-9587 |
high | 7.1 | 0.0038 | 2026-07-17 | An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104 | |
CVE-2026-58484 |
high | 7.1 | 0.0020 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentMa | |
CVE-2026-65896 |
high | 7.1 | 0.0032 | 2026-07-23 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate | |
CVE-2026-64816 |
high | 7.1 | 0.0045 | 2026-07-30 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File: | |
CVE-2026-18806 |
high | 7.1 | 0.0015 | 2026-08-04 | External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research | |
CVE-2026-73619 |
high | 7.1 | 0.0041 | 2026-08-13 | GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that | |
CVE-2026-75830 |
high | 7.1 | 0.0039 | 2026-08-18 | grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path tra | |
CVE-2026-48798 |
high | 7.1 | 0.0042 | 2026-08-18 | SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string | |
CVE-2026-45008 |
high | 7.0 | 0.0027 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that all | |
CVE-2026-114491 |
medium | 6.9 | 0.0026 | 2026-10-21 | pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenc | |
CVE-2026-116822 |
medium | 6.9 | 0.0021 | 2026-10-27 | YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthe | |
CVE-2026-34030 |
medium | 6.9 | 0.0033 | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validat | |
CVE-2026-50162 |
medium | 6.9 | 0.0044 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/fi | |
CVE-2026-65939 |
medium | 6.8 | 0.0038 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile acti | |
CVE-2026-42866 |
medium | 6.7 | 0.0021 | 2026-05-11 | Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_t | |
CVE-2026-66324 |
medium | 6.5 | 0.0092 | 2026-08-28 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized atta | |
CVE-2026-54108 |
medium | 6.5 | 0.0108 | 2026-07-14 | External control of file name or path in Microsoft Office SharePoint allows an authorized attacker t | |
CVE-2026-33989 |
medium | 6.5 | 0.0050 | 2026-03-27 | Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@m | |
CVE-2026-39377 |
medium | 6.5 | 0.0027 | 2026-04-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja | |
CVE-2026-39378 |
medium | 6.5 | 0.0031 | 2026-04-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja | |
CVE-2026-45139 |
medium | 6.5 | 0.0032 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fi | |
CVE-2026-5461 |
medium | 6.5 | — | 2026-10-30 | The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up | |
CVE-2026-13748 |
medium | 6.3 | 0.0019 | 2026-06-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitra | |
CVE-2026-57208 |
medium | 6.2 | 0.0038 | 2026-10-23 | Entire CLI hooks into Git workflows to capture AI agent sessions. Prior to version 0.7.7, a path tra | |
CVE-2026-48520 |
medium | 6.1 | 0.0044 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the | |
CVE-2026-17431 |
medium | 6.1 | 0.0095 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the outpu | |
CVE-2026-119198 |
medium | 5.9 | — | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, a client with T |