Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42792 |
medium | 6.3 | 0.0043 | 2026-07-27 | Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauth | |
CVE-2026-64646 |
medium | 6.3 | 0.0052 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15 | |
CVE-2026-114386 |
medium | 6.3 | 0.0035 | 2026-10-21 | Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls | |
CVE-2026-116120 |
medium | 6.3 | 0.0028 | 2026-10-26 | A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function Us | |
CVE-2026-104436 |
medium | 6.3 | 0.0027 | 2026-10-02 | Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2 | |
CVE-2026-35480 |
medium | 6.2 | 0.0016 | 2026-04-07 | go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batte | |
CVE-2026-24271 |
medium | 6.2 | 0.0016 | 2026-07-14 | NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attack | |
CVE-2026-63119 |
medium | 6.2 | 0.0019 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23. | |
CVE-2026-33812 |
medium | 6.1 | 0.0011 | 2026-04-21 | Parsing a malicious font file can cause excessive memory allocation. | |
CVE-2026-113790 |
medium | 6.0 | 0.0039 | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PD | |
CVE-2026-45802 |
medium | 6.0 | 0.0026 | 2026-06-11 | FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and us | |
CVE-2026-54429 |
medium | 6.0 | 0.0027 | 2026-07-14 | A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices d | |
CVE-2026-113791 |
medium | 6.0 | 0.0039 | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PD | |
CVE-2026-113795 |
medium | 6.0 | 0.0047 | 2026-10-21 | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF st | |
CVE-2026-67414 |
medium | 6.0 | 0.0054 | 2026-10-14 | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, de | |
CVE-2026-116579 |
medium | 5.9 | 0.0043 | 2026-10-26 | Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. | |
CVE-2026-96300 |
medium | 5.9 | 0.0093 | 2026-10-13 | Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to | |
CVE-2026-41078 |
medium | 5.9 | 0.0022 | 2026-04-23 | OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Expor | |
CVE-2026-41173 |
medium | 5.9 | 0.0030 | 2026-04-23 | The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from A | |
CVE-2026-41483 |
medium | 5.9 | 0.0032 | 2026-05-06 | OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15 | |
CVE-2026-41484 |
medium | 5.9 | 0.0034 | 2026-05-06 | OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-e | |
CVE-2026-44216 |
medium | 5.9 | 0.0032 | 2026-05-14 | Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocat | |
CVE-2026-53423 |
medium | 5.9 | 0.0026 | 2026-06-11 | Allocation of Resources Without Limits or Throttling vulnerability in membraneframework membrane_mp4 | |
CVE-2026-45712 |
medium | 5.9 | 0.0034 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/pri | |
CVE-2026-16971 |
medium | 5.9 | 0.0033 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation a | |
CVE-2026-18362 |
medium | 5.9 | 0.0037 | 2026-07-30 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authenticat | |
CVE-2026-58238 |
medium | 5.9 | 0.0043 | 2026-08-11 | SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenti | |
CVE-2026-49870 |
medium | 5.9 | 0.0040 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limi | |
CVE-2026-115381 |
medium | 5.9 | 0.0021 | 2026-10-22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an unbounded memory | |
CVE-2026-15007 |
medium | 5.7 | 0.0064 | 2026-07-17 | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authent | |
CVE-2026-102682 |
medium | 5.6 | 0.0023 | 2026-10-14 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa | |
CVE-2025-63402 |
medium | 5.5 | 0.0033 | 2025-12-03 | An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execu | |
CVE-2026-98113 |
medium | 5.5 | 0.0015 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: rate limit unmapped SID | |
CVE-2026-108309 |
medium | 5.5 | 0.0011 | 2026-10-27 | Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. | |
CVE-2026-40608 |
medium | 5.5 | 0.0015 | 2026-04-21 | Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. | |
CVE-2026-42444 |
medium | 5.5 | 0.0011 | 2026-05-12 | NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, a denial-of-service vu | |
CVE-2026-12570 |
medium | 5.5 | 0.0019 | 2026-08-10 | A vulnerability in keras-team/keras versions <= 3.15.0 allows for a denial of service (DoS) attack w | |
CVE-2026-98126 |
medium | 5.5 | 0.0012 | 2026-09-25 | In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF fo | |
CVE-2026-86018 |
medium | 5.3 | 0.0040 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-115927 |
medium | 5.3 | 0.0038 | 2026-10-26 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decod | |
CVE-2026-108310 |
medium | 5.3 | 0.0031 | 2026-10-27 | Tanium addressed a denial of service vulnerability in Tanium Server. | |
CVE-2026-116657 |
medium | 5.3 | 0.0034 | 2026-10-27 | Tanium addressed a denial of service vulnerability in Enforce. | |
CVE-2026-92665 |
medium | 5.3 | 0.0041 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-88084 |
medium | 5.3 | 0.0068 | 2026-10-13 | Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to | |
CVE-2026-34062 |
medium | 5.3 | 0.0030 | 2026-04-22 | nimiq-libp2p is a Nimiq network implementation based on libp2p. Prior to version 1.3.0, `MessageCode | |
CVE-2026-41310 |
medium | 5.3 | 0.0031 | 2026-05-06 | OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and | |
CVE-2026-41648 |
medium | 5.3 | 0.0027 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image | |
CVE-2026-44500 |
medium | 5.3 | 0.0036 | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain | |
CVE-2026-8202 |
medium | 5.3 | 0.0026 | 2026-05-13 | Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $ | |
CVE-2026-53781 |
medium | 5.3 | 0.0032 | 2026-06-11 | Summarize before 0.17.0 contains a resource exhaustion vulnerability that allows remote attackers to |