Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54063 |
high | 7.5 | 0.0061 | 2026-07-10 | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1 | |
CVE-2026-57220 |
high | 7.5 | 0.0055 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not | |
CVE-2026-12707 |
high | 7.5 | 0.0044 | 2026-07-14 | Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to un | |
CVE-2026-60081 |
high | 7.5 | 0.0063 | 2026-07-14 | DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column | |
CVE-2026-59200 |
high | 7.5 | 0.0039 | 2026-07-14 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/Pdf | |
CVE-2026-49476 |
high | 7.5 | 0.0064 | 2026-07-14 | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the | |
CVE-2026-21729 |
high | 7.5 | 0.0046 | 2026-07-16 | Loki queries with large limits can cause large memory allocations which can impact the availability | |
CVE-2026-44433 |
high | 7.5 | 0.0049 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server | |
CVE-2026-50273 |
high | 7.5 | 0.0079 | 2026-07-17 | Datadog .NET Tracer is a client library for Datadog APM for .NET applications. Prior to 3.43.0, Data | |
CVE-2026-49835 |
high | 7.5 | 0.0074 | 2026-07-17 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the globa | |
CVE-2026-50271 |
high | 7.5 | 0.0079 | 2026-07-17 | Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that | |
CVE-2026-50272 |
high | 7.5 | 0.0079 | 2026-07-17 | dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in package | |
CVE-2026-50274 |
high | 7.5 | 0.0079 | 2026-07-17 | Datadog dd-trace-go is a Go client library for Datadog application performance monitoring, profiling | |
CVE-2026-45713 |
high | 7.5 | 0.0061 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP s | |
CVE-2026-11622 |
high | 7.5 | 0.0054 | 2026-07-22 | A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone ca | |
CVE-2026-14257 |
high | 7.5 | 0.0064 | 2026-07-23 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() | |
CVE-2026-25800 |
high | 7.5 | 0.0084 | 2026-07-23 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting | |
CVE-2026-61609 |
high | 7.5 | 0.0050 | 2026-07-28 | Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authen | |
CVE-2026-54638 |
high | 7.5 | 0.0063 | 2026-07-28 | gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode | |
CVE-2026-67432 |
high | 7.5 | 0.0078 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23. | |
CVE-2026-11897 |
high | 7.5 | 0.0053 | 2026-07-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of se | |
CVE-2026-16308 |
high | 7.5 | 0.0055 | 2026-07-30 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus RES | |
CVE-2026-69152 |
high | 7.5 | 0.0065 | 2026-08-03 | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior | |
CVE-2026-66257 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaus | |
CVE-2026-67465 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaus | |
CVE-2026-67588 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaus | |
CVE-2026-68060 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation | |
CVE-2026-68074 |
high | 7.5 | 0.0077 | 2026-08-05 | A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaus | |
CVE-2026-67592 |
high | 7.5 | 0.0074 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling | |
CVE-2026-59675 |
high | 7.5 | 0.0056 | 2026-08-05 | When API audit logging is enabled, the middleware reads the entire HTTP request body into memory wit | |
CVE-2026-54225 |
high | 7.5 | 0.0073 | 2026-08-06 | Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apa | |
CVE-2026-52879 |
high | 7.5 | 0.0049 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7 | |
CVE-2026-52880 |
high | 7.5 | 0.0049 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1 | |
CVE-2026-15561 |
high | 7.5 | 0.0085 | 2026-08-11 | A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and cou | |
CVE-2026-17271 |
high | 7.5 | 0.0055 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro | |
CVE-2026-71469 |
high | 7.5 | 0.0074 | 2026-08-12 | A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests | |
CVE-2026-73493 |
high | 7.5 | 0.0063 | 2026-08-12 | Http4s (http4s-blaze-server) is a minimal, idiomatic Scala interface for HTTP services. Prior to 0.2 | |
CVE-2026-48702 |
high | 7.5 | 0.0046 | 2026-08-13 | Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1. | |
CVE-2026-56862 |
high | 7.5 | 0.0057 | 2026-08-13 | Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of wheth | |
CVE-2026-73997 |
high | 7.5 | 0.0046 | 2026-08-18 | Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions. | |
CVE-2026-47628 |
high | 7.5 | 0.0067 | 2026-08-18 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an a | |
CVE-2026-50142 |
high | 7.5 | 0.0066 | 2026-08-18 | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.0, a crafted HEIF | |
CVE-2026-63495 |
high | 7.5 | 0.0061 | 2026-08-20 | Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebS | |
CVE-2026-17163 |
high | 7.5 | 0.0055 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-17170 |
high | 7.5 | 0.0055 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-57487 |
high | 7.5 | 0.0041 | 2026-10-16 | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Trans | |
CVE-2026-113658 |
high | 7.5 | 0.0062 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthentica | |
CVE-2026-74757 |
high | 7.5 | 0.0063 | 2026-10-21 | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all | |
CVE-2026-114136 |
high | 7.5 | 0.0044 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse | |
CVE-2026-114144 |
high | 7.5 | 0.0044 | 2026-10-21 | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounde |