Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-96365 |
high | 7.5 | 0.0041 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessiv | |
CVE-2026-115482 |
high | 7.5 | 0.0045 | 2026-10-22 | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the | |
CVE-2026-75508 |
high | 7.5 | 0.0057 | 2026-10-22 | GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.2.3 until 3.2.12 an | |
CVE-2026-115776 |
high | 7.5 | 0.0050 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.1 | |
CVE-2026-115778 |
high | 7.5 | 0.0054 | 2026-10-23 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.1 | |
CVE-2026-105626 |
high | 7.5 | 0.0043 | 2026-10-26 | HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that ma | |
CVE-2026-116584 |
high | 7.5 | 0.0037 | 2026-10-26 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.strin | |
CVE-2026-110678 |
high | 7.5 | 0.0017 | 2026-10-19 | Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental inpu | |
CVE-2026-29168 |
high | 7.3 | 0.0063 | 2026-05-05 | Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md v | |
CVE-2026-63572 |
high | 7.1 | 0.0038 | 2026-10-02 | Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of t | |
CVE-2026-63578 |
high | 7.1 | 0.0038 | 2026-10-02 | Allocation of resources without limits in password-based private-key decryption (PbeUtilities.Genera | |
CVE-2026-39959 |
high | 7.1 | 0.0012 | 2026-04-09 | Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol | |
CVE-2026-35602 |
high | 7.1 | 0.0034 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file imp | |
CVE-2026-12760 |
high | 7.1 | 0.0036 | 2026-06-24 | A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet ha | |
CVE-2026-57212 |
high | 7.1 | 0.0043 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbi | |
CVE-2026-13069 |
high | 7.1 | 0.0029 | 2026-07-22 | An authenticated user can cause excessive CPU consumption or out-of-memory conditions on a MongoDB s | |
CVE-2026-13075 |
high | 7.1 | 0.0042 | 2026-07-22 | An authenticated user can cause the mongod process to be terminated by the operating system under me | |
CVE-2026-13076 |
high | 7.1 | 0.0042 | 2026-07-22 | An authenticated user can cause a {{mongod}} process to be terminated by the operating system under | |
CVE-2026-67199 |
high | 7.1 | 0.0052 | 2026-08-04 | Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block t | |
CVE-2026-63133 |
high | 7.1 | 0.0055 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extrac | |
CVE-2026-74039 |
high | 7.1 | 0.0056 | 2026-08-18 | Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows auth | |
CVE-2026-109298 |
high | 7.1 | 0.0047 | 2026-10-12 | Open WebUI 0.11.0 before 0.11.4 compiles user-chosen grep patterns for its knowledge and chat file s | |
CVE-2026-109351 |
high | 7.1 | 0.0032 | 2026-10-12 | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows | |
CVE-2026-111384 |
high | 7.1 | 0.0036 | 2026-10-16 | Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager W | |
CVE-2026-119209 |
high | 7.1 | — | 2026-10-29 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.3, pypdf can consume excessiv | |
CVE-2026-77468 |
medium | 6.9 | 0.0037 | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, GET /docs/api exposes the Scram | |
CVE-2026-22815 |
medium | 6.9 | 0.0046 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-40104 |
medium | 6.9 | 0.0040 | 2026-04-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of | |
CVE-2026-42788 |
medium | 6.9 | 0.0051 | 2026-05-01 | Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthen | |
CVE-2026-6860 |
medium | 6.9 | 0.0024 | 2026-05-06 | A TCP client can perform a TLS handshake and present the server name extension with a server name th | |
CVE-2026-10740 |
medium | 6.9 | 0.0029 | 2026-06-10 | Unbounded memory allocation in the CRYPTO frame reassembler in s2n-quic before 1.8.2 may allow an un | |
CVE-2026-27869 |
medium | 6.9 | 0.0039 | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case | |
CVE-2026-55205 |
medium | 6.9 | 0.0052 | 2026-06-18 | Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POS | |
CVE-2026-54448 |
medium | 6.9 | 0.0044 | 2026-06-25 | Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive (.tgz), its cust | |
CVE-2026-56814 |
medium | 6.9 | 0.0108 | 2026-07-10 | Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart | |
CVE-2026-54463 |
medium | 6.9 | 0.0049 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions | |
CVE-2026-13074 |
medium | 6.9 | 0.0044 | 2026-07-22 | An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending | |
CVE-2026-45112 |
medium | 6.9 | 0.0103 | 2026-07-27 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. | |
CVE-2026-65624 |
medium | 6.9 | 0.0038 | 2026-07-28 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an una | |
CVE-2026-54894 |
medium | 6.9 | 0.0048 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service | |
CVE-2026-55733 |
medium | 6.9 | 0.0048 | 2026-08-01 | Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service | |
CVE-2026-55734 |
medium | 6.9 | 0.0048 | 2026-08-01 | Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.P | |
CVE-2026-18401 |
medium | 6.9 | 0.0041 | 2026-08-04 | The non-blocking (asynchronous) JSON parser in jackson-core does not enforce the maxNumberLength con | |
CVE-2026-115391 |
medium | 6.9 | 0.0017 | 2026-10-22 | Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 contains an uncontrolled resource allocation | |
CVE-2026-119134 |
medium | 6.9 | — | 2026-10-29 | Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resourc | |
CVE-2026-45078 |
medium | 6.8 | 0.0013 | 2026-05-28 | Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated us | |
CVE-2026-115395 |
medium | 6.8 | 0.0012 | 2026-10-22 | Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.r | |
CVE-2026-115397 |
medium | 6.8 | 0.0012 | 2026-10-22 | Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unz | |
CVE-2026-115398 |
medium | 6.8 | 0.0016 | 2026-10-22 | Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHel | |
CVE-2026-34516 |
medium | 6.6 | 0.0046 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 |