Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2022-43768 |
high | 7.5 | 0.0095 | 2023-04-11 | A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3. | |
CVE-2023-2828 |
high | 7.5 | 0.0370 | 2023-06-21 | Every `named` instance configured to run as a recursive resolver maintains a cache database holding | |
CVE-2023-36521 |
high | 7.5 | 0.0063 | 2023-07-11 | A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All | |
CVE-2026-27857 |
high | 7.5 | 0.0068 | 2026-03-27 | Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage | |
CVE-2026-31935 |
high | 7.5 | 0.0027 | 2026-04-02 | Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, flooding of craft | |
CVE-2026-34148 |
high | 7.5 | 0.0055 | 2026-04-06 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1 | |
CVE-2026-33034 |
high | 7.5 | 0.0077 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests | |
CVE-2026-5438 |
high | 7.5 | 0.0048 | 2026-04-09 | A gzip decompression bomb vulnerability exists when Orthanc processes HTTP request with `Content-Enc | |
CVE-2026-5439 |
high | 7.5 | 0.0043 | 2026-04-09 | A memory exhaustion vulnerability exists in ZIP archive processing. Orthanc automatically extracts Z | |
CVE-2026-5440 |
high | 7.5 | 0.0057 | 2026-04-09 | A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Len | |
CVE-2026-40115 |
high | 7.5 | 0.0033 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the WSGI-based recipe registry server (se | |
CVE-2026-40116 |
high | 7.5 | 0.0037 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /media-stream WebSocket endpoint in P | |
CVE-2026-40395 |
high | 7.5 | 0.0024 | 2026-04-12 | Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) f | |
CVE-2026-33256 |
high | 7.5 | 0.0061 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web serve | |
CVE-2026-33257 |
high | 7.5 | 0.0051 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web serve | |
CVE-2026-33258 |
high | 7.5 | 0.0058 | 2026-04-22 | By publishing and querying a crafted zone an attacker can cause allocation of large entries in the n | |
CVE-2026-33260 |
high | 7.5 | 0.0052 | 2026-04-22 | An attacker can send a web request that causes unlimited memory allocation in the internal web serve | |
CVE-2026-33254 |
high | 7.5 | 0.0037 | 2026-04-22 | An attacker can create a large number of concurrent DoQ or DoH3 connections, causing unlimited memor | |
CVE-2026-33594 |
high | 7.5 | 0.0037 | 2026-04-22 | A client can trigger excessive memory allocation by generating a lot of queries that are routed to a | |
CVE-2026-33595 |
high | 7.5 | 0.0037 | 2026-04-22 | A client can trigger excessive memory allocation by generating a lot of errors responses over a sing | |
CVE-2026-41324 |
high | 7.5 | 0.0033 | 2026-04-24 | basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service | |
CVE-2026-7776 |
high | 7.5 | 0.0020 | 2026-05-04 | Boundary Community Edition and Boundary Enterprise (“Boundary”) workers are vulnerable to a denial-o | |
CVE-2026-39820 |
high | 7.5 | 0.0078 | 2026-05-07 | Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger exce | |
CVE-2026-42189 |
high | 7.5 | 0.0048 | 2026-05-08 | Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of | |
CVE-2026-41284 |
high | 7.5 | 0.0084 | 2026-05-12 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue aff | |
CVE-2026-23826 |
high | 7.5 | 0.0040 | 2026-05-12 | A vulnerability in a network management service of AOS-8 Operating System could allow an unauthentic | |
CVE-2026-44240 |
high | 7.5 | 0.0051 | 2026-05-12 | basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denia | |
CVE-2026-40863 |
high | 7.5 | 0.0040 | 2026-05-12 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1 | |
CVE-2026-40902 |
high | 7.5 | 0.0040 | 2026-05-12 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1 | |
CVE-2026-42582 |
high | 7.5 | 0.0044 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when de | |
CVE-2026-42583 |
high | 7.5 | 0.0046 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-44248 |
high | 7.5 | 0.0056 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-1718 |
high | 7.5 | 0.0036 | 2026-05-27 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a denial of service with a | |
CVE-2026-45290 |
high | 7.5 | 0.0028 | 2026-06-05 | Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in v | |
CVE-2026-5497 |
high | 7.5 | 0.0054 | 2026-06-11 | vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attac | |
CVE-2026-54283 |
high | 7.5 | 0.0048 | 2026-06-22 | Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts ma | |
CVE-2026-48933 |
high | 7.5 | 0.0371 | 2026-06-26 | A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` | |
CVE-2026-57080 |
high | 7.5 | 0.0049 | 2026-06-30 | Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer- | |
CVE-2026-20216 |
high | 7.5 | 0.0057 | 2026-07-01 | A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, re | |
CVE-2026-56150 |
high | 7.5 | 0.0048 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial | |
CVE-2026-54428 |
high | 7.5 | 0.0087 | 2026-07-01 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpCompo | |
CVE-2026-33592 |
high | 7.5 | 0.0052 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service i | |
CVE-2026-9563 |
high | 7.5 | 0.0035 | 2026-07-02 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not e | |
CVE-2026-11946 |
high | 7.5 | 0.0052 | 2026-07-02 | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service | |
CVE-2026-60000 |
high | 7.5 | 0.0062 | 2026-07-08 | sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumpti | |
CVE-2026-49146 |
high | 7.5 | 0.0061 | 2026-07-08 | App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a | |
CVE-2026-59868 |
high | 7.5 | 0.0064 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled | |
CVE-2026-59870 |
high | 7.5 | 0.0074 | 2026-07-08 | js-yaml is a JavaScript YAML parser and dumper. Prior to 3.15.1, 4.3.1, and 5.2.1, YAML11_SCHEMA sup | |
CVE-2026-49866 |
high | 7.5 | 0.0063 | 2026-07-08 | libp2p is a JavaScript Implementation of libp2p networking stack. Prior to 16.0.0, @libp2p/gossipsub | |
CVE-2026-40006 |
high | 7.5 | 0.0058 | 2026-07-10 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, M |