Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54270 |
medium | 5.3 | 0.0040 | 2026-06-22 | protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protob | |
CVE-2026-54285 |
medium | 5.3 | 0.0040 | 2026-06-22 | opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extrac | |
CVE-2026-40211 |
medium | 5.3 | 0.0070 | 2026-06-25 | An attacker can send crafted DNS over HTTP/3 queries, triggering an exception that prevents some buf | |
CVE-2026-56309 |
medium | 5.3 | 0.0031 | 2026-07-10 | Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endp | |
CVE-2026-58661 |
medium | 5.3 | 0.0039 | 2026-07-10 | n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerabi | |
CVE-2026-46629 |
medium | 5.3 | 0.0054 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and | |
CVE-2026-49209 |
medium | 5.3 | 0.0056 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.5.0 until 2.36.0 and 3.1.0, Symfony\UX\Live | |
CVE-2026-48504 |
medium | 5.3 | 0.0042 | 2026-07-17 | OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagato | |
CVE-2026-48824 |
medium | 5.3 | 0.0054 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-f | |
CVE-2026-53596 |
medium | 5.3 | 0.0029 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-47013 |
medium | 5.3 | 0.0041 | 2026-07-21 | Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Ora | |
CVE-2026-67430 |
medium | 5.3 | 0.0037 | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23. | |
CVE-2026-73228 |
medium | 5.3 | 0.0056 | 2026-08-11 | Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's r | |
CVE-2026-71408 |
medium | 5.3 | 0.0042 | 2026-08-12 | A allocation of resources without limits or throttling vulnerability in Fortinet FortiOS 7.6.0 throu | |
CVE-2026-73565 |
medium | 5.3 | 0.0053 | 2026-08-13 | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSock | |
CVE-2026-75841 |
medium | 5.3 | 0.0037 | 2026-08-18 | ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function tha | |
CVE-2026-52732 |
medium | 5.3 | 0.0051 | 2026-08-18 | ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can mon | |
CVE-2026-53585 |
medium | 5.3 | 0.0040 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a | |
CVE-2026-110595 |
medium | 5.3 | 0.0051 | 2026-10-14 | BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_uplo | |
CVE-2026-96405 |
medium | 5.3 | 0.0025 | 2026-10-21 | NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each | |
CVE-2026-96377 |
medium | 5.3 | 0.0034 | 2026-10-22 | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style al | |
CVE-2026-114731 |
medium | 5.3 | 0.0043 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consu | |
CVE-2026-115454 |
medium | 5.3 | 0.0037 | 2026-10-22 | An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business | |
CVE-2026-86019 |
medium | 5.3 | 0.0025 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-116577 |
medium | 5.3 | 0.0038 | 2026-10-26 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP | |
CVE-2026-44931 |
medium | 5.1 | 0.0015 | 2026-05-13 | The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/- | |
CVE-2026-115380 |
medium | 5.1 | 0.0012 | 2026-10-22 | Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service | |
CVE-2026-44253 |
medium | 4.9 | 0.0061 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3 | |
CVE-2026-6948 |
medium | 4.9 | 0.0034 | 2026-05-04 | Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's ag | |
CVE-2026-56149 |
medium | 4.9 | 0.0050 | 2026-07-01 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial | |
CVE-2026-14362 |
medium | 4.9 | 0.0025 | 2026-07-08 | HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pul | |
CVE-2026-116143 |
medium | 4.8 | 0.0012 | 2026-10-25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a policy bypass in the PS, PDF and XPS | |
CVE-2026-71139 |
medium | 4.4 | 0.0016 | 2026-08-18 | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The | |
CVE-2026-116659 |
medium | 4.3 | 0.0030 | 2026-10-27 | Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. | |
CVE-2026-116773 |
medium | 4.3 | 0.0026 | 2026-10-27 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Pr | |
CVE-2026-41685 |
medium | 4.3 | 0.0033 | 2026-05-07 | Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large am | |
CVE-2026-49337 |
medium | 4.3 | 0.0024 | 2026-06-19 | libde265 is an open source implementation of the h.265 video codec. Prior to version 1.0.20, a craft | |
CVE-2026-8287 |
medium | 4.3 | 0.0036 | 2026-07-23 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems | |
CVE-2026-55996 |
medium | 4.3 | 0.0024 | 2026-08-05 | A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the catt | |
CVE-2026-66761 |
medium | 4.3 | 0.0038 | 2026-08-11 | SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with lo | |
CVE-2026-71486 |
medium | 4.3 | 0.0037 | 2026-08-17 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completi | |
CVE-2026-19867 |
medium | 4.3 | 0.0021 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail t | |
CVE-2026-13322 |
low | 3.8 | 0.0013 | 2026-06-26 | A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest request | |
CVE-2026-42546 |
low | 3.8 | 0.0015 | 2026-07-06 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r | |
CVE-2026-22018 |
low | 3.7 | 0.0027 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-44219 |
low | 3.7 | 0.0030 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.6.0 to 0.8.1, both SCA HTTP clients | |
CVE-2026-48082 |
low | 3.7 | 0.0039 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-114723 |
low | 3.7 | 0.0033 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be | |
CVE-2026-116696 |
low | 3.3 | 0.0011 | 2026-10-27 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Pr | |
CVE-2026-18096 |
low | 3.3 | 0.0013 | 2026-08-12 | IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacke |