Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54273 |
medium | 6.6 | 0.0049 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no | |
CVE-2026-54274 |
medium | 6.6 | 0.0054 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if | |
CVE-2026-54277 |
medium | 6.6 | 0.0056 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it | |
CVE-2026-14539 |
medium | 6.6 | 0.0024 | 2026-07-31 | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp- | |
CVE-2026-73196 |
medium | 6.5 | 0.0043 | 2026-08-20 | A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by su | |
CVE-2026-70072 |
medium | 6.5 | 0.0123 | 2026-10-13 | Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attack | |
CVE-2025-36061 |
medium | 6.5 | 0.0032 | 2026-10-19 | IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4 | |
CVE-2026-96638 |
medium | 6.5 | 0.0034 | 2026-10-21 | Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDecoder.decode() in src/PIL/BmpIm | |
CVE-2026-114610 |
medium | 6.5 | 0.0046 | 2026-10-22 | fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() p | |
CVE-2026-115911 |
medium | 6.5 | 0.0031 | 2026-10-26 | vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authent | |
CVE-2026-115913 |
medium | 6.5 | 0.0033 | 2026-10-26 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multim | |
CVE-2026-115918 |
medium | 6.5 | 0.0035 | 2026-10-26 | vLLM is an inference and serving engine for large language models. From 0.16.0 until 0.32.0, the /v1 | |
CVE-2026-54462 |
medium | 6.5 | 0.0038 | 2026-10-27 | Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-202605310000 | |
CVE-2023-23916 |
medium | 6.5 | 0.0174 | 2023-02-23 | An allocation of resources without limits or throttling vulnerability exists in curl <v7.88.0 based | |
CVE-2023-0616 |
medium | 6.5 | 0.0049 | 2023-06-02 | If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attem | |
CVE-2026-28376 |
medium | 6.5 | 0.0033 | 2026-05-13 | The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a la | |
CVE-2026-28383 |
medium | 6.5 | 0.0033 | 2026-05-13 | A request to the Grafana plugin resources endpoint can cause unbounded memory allocation by reading | |
CVE-2026-53522 |
medium | 6.5 | 0.0035 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-54024 |
medium | 6.5 | 0.0044 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the | |
CVE-2026-54037 |
medium | 6.5 | 0.0051 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the | |
CVE-2026-49087 |
medium | 6.5 | 0.0047 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser | |
CVE-2026-55646 |
medium | 6.5 | 0.0052 | 2026-07-06 | vLLM is an inference and serving engine for large language models. From 0.22.0 to 0.23.0, the /v1/au | |
CVE-2026-41899 |
medium | 6.5 | 0.0036 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-60001 |
medium | 6.5 | 0.0029 | 2026-07-08 | sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay. | |
CVE-2026-62641 |
medium | 6.5 | 0.0047 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of | |
CVE-2026-42397 |
medium | 6.5 | 0.0042 | 2026-07-21 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of ser | |
CVE-2026-20482 |
medium | 6.5 | 0.0030 | 2026-08-03 | In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to | |
CVE-2026-66275 |
medium | 6.5 | 0.0065 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading | |
CVE-2026-66277 |
medium | 6.5 | 0.0065 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling | |
CVE-2026-67553 |
medium | 6.5 | 0.0065 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading | |
CVE-2026-67555 |
medium | 6.5 | 0.0065 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling | |
CVE-2026-67591 |
medium | 6.5 | 0.0065 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading | |
CVE-2026-68075 |
medium | 6.5 | 0.0065 | 2026-08-05 | An authenticated attacker could exceed the session flow control incoming window potentially leading | |
CVE-2026-68078 |
medium | 6.5 | 0.0065 | 2026-08-05 | It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling | |
CVE-2026-19517 |
medium | 6.5 | 0.0036 | 2026-08-11 | Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Thr | |
CVE-2026-72653 |
medium | 6.5 | 0.0042 | 2026-08-13 | Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of servi | |
CVE-2026-75050 |
medium | 6.5 | 0.0106 | 2026-08-17 | In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type pa | |
CVE-2026-14511 |
medium | 6.5 | 0.0033 | 2026-10-19 | IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sen | |
CVE-2026-76289 |
medium | 6.5 | 0.0037 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold th | |
CVE-2026-90991 |
medium | 6.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial | |
CVE-2026-16251 |
medium | 6.5 | 0.0028 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-116694 |
medium | 6.3 | 0.0038 | 2026-10-27 | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropa | |
CVE-2026-40881 |
medium | 6.3 | 0.0026 | 2026-04-21 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network vers | |
CVE-2026-7541 |
medium | 6.3 | 0.0039 | 2026-05-07 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthe | |
CVE-2026-59246 |
medium | 6.3 | 0.0050 | 2026-07-14 | Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 serv | |
CVE-2026-10573 |
medium | 6.3 | 0.0033 | 2026-07-14 | A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from i | |
CVE-2026-55407 |
medium | 6.3 | 0.0076 | 2026-07-16 | Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Pri | |
CVE-2026-54464 |
medium | 6.3 | 0.0044 | 2026-07-17 | ### Impact If this library is used in tandem with the `permessage-deflate` extension, a WebSocket s | |
CVE-2026-54465 |
medium | 6.3 | 0.0049 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket- | |
CVE-2026-54490 |
medium | 6.3 | 0.0044 | 2026-07-17 | websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library |