Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42145 |
low | 3.1 | 0.0039 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-34513 |
low | 2.7 | 0.0046 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-34517 |
low | 2.7 | 0.0040 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1 | |
CVE-2026-116775 |
low | 2.3 | 0.0029 | 2026-10-27 | pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be use | |
CVE-2026-5316 |
low | 2.1 | 0.0044 | 2026-04-02 | A vulnerability was identified in Nothings stb up to 1.22. The impacted element is the function setu | |
CVE-2026-115389 |
low | 1.0 | 0.0015 | 2026-10-22 | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not adequately account | |
CVE-2026-111073 |
— | — | 0.0020 | 2026-10-28 | The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics | |
CVE-2026-111108 |
— | — | 0.0027 | 2026-10-28 | Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count | |
CVE-2026-116131 |
— | — | 0.0031 | 2026-10-28 | HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimi | |
CVE-2026-116134 |
— | — | 0.0031 | 2026-10-28 | HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part | |
CVE-2026-116273 |
— | — | 0.0018 | 2026-10-28 | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, | |
CVE-2026-117501 |
— | — | 0.0024 | 2026-10-28 | HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunk | |
CVE-2026-27858 |
— | — | 0.0080 | 2026-03-27 | Attacker can send a specifically crafted message before authentication that causes managesieve to al | |
CVE-2026-39304 |
— | — | 0.0090 | 2026-04-10 | Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, | |
CVE-2026-5807 |
— | — | 0.0072 | 2026-04-17 | Vault is vulnerable to a denial-of-service condition where an unauthenticated attacker can repeatedl | |
CVE-2026-21728 |
— | — | 0.0064 | 2026-04-24 | Tempo queries with large limits can cause large memory allocations which can impact the availability | |
CVE-2026-42440 |
— | — | 0.0060 | 2026-05-04 | OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Version | |
CVE-2026-42006 |
— | — | 0.0062 | 2026-05-12 | An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-202 | |
CVE-2026-44577 |
— | — | 0.0074 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 | |
CVE-2026-44004 |
— | — | 0.0042 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc( | |
CVE-2026-44579 |
— | — | 0.0075 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From to before 15.5.16 and 1 | |
CVE-2026-42587 |
— | — | 0.0099 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-42561 |
— | — | 0.0074 | 2026-05-13 | Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a | |
CVE-2026-48779 |
— | — | 0.0143 | 2026-06-17 | ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not | |
CVE-2026-47774 |
— | — | 0.0097 | 2026-06-17 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to vers | |
CVE-2026-54297 |
— | — | 0.0076 | 2026-06-24 | Faraday is an HTTP client library abstraction layer that provides a common interface over many adapt | |
CVE-2026-86892 |
— | — | 0.0015 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPa | |
CVE-2026-85783 |
— | — | 0.0022 | 2026-10-20 | Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient | |
CVE-2026-56387 |
— | — | 0.0027 | 2026-10-21 | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrust | |
CVE-2026-58064 |
— | — | 0.0020 | 2026-10-21 | The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy | |
CVE-2026-78066 |
— | — | 0.0016 | 2026-10-21 | Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept | |
CVE-2026-80463 |
— | — | 0.0020 | 2026-10-21 | Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0 | |
CVE-2026-113811 |
— | — | 0.0023 | 2026-10-21 | Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a nev | |
CVE-2026-115817 |
— | — | 0.0030 | 2026-10-25 | Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, | |
CVE-2026-115824 |
— | — | 0.0033 | 2026-10-25 | Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked r |