Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-33874 |
high | 7.8 | 0.0029 | 2026-03-27 | Gematik Authenticator securely authenticates users for login to digital health applications. Startin | |
CVE-2026-33641 |
high | 7.8 | 0.0087 | 2026-04-02 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, Glances sup | |
CVE-2026-35043 |
high | 7.8 | 0.0032 | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and model infe | |
CVE-2026-44709 |
high | 7.8 | 0.0015 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, p | |
CVE-2026-45152 |
high | 7.8 | 0.0083 | 2026-05-27 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command inject | |
CVE-2026-45322 |
high | 7.8 | 0.0245 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microso | |
CVE-2026-48703 |
high | 7.8 | 0.0025 | 2026-06-24 | Warp is an agentic development environment. From 0.2025.04.09.08.11.stable_00 until 0.2026.05.06.15. | |
CVE-2026-48731 |
high | 7.8 | 0.0089 | 2026-06-24 | Warp is an agentic development environment. From 0.2024.02.20.08.01.stable_01 until 0.2026.05.06.15. | |
CVE-2026-46735 |
high | 7.8 | 0.0082 | 2026-06-25 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutraliz | |
CVE-2026-46606 |
high | 7.8 | 0.0019 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances KVM/QEM | |
CVE-2026-46709 |
high | 7.8 | 0.0025 | 2026-07-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.234, Tabby insert | |
CVE-2026-44190 |
high | 7.8 | 0.0075 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Visual Studio Code extension. This Command Injection vuln | |
CVE-2026-44191 |
high | 7.8 | 0.0082 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vuln | |
CVE-2026-16287 |
high | 7.8 | 0.0084 | 2026-07-23 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi | |
CVE-2026-24252 |
high | 7.8 | 0.0149 | 2026-07-27 | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A s | |
CVE-2026-16022 |
high | 7.8 | 0.0082 | 2026-08-05 | @oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functiona | |
CVE-2026-48097 |
high | 7.8 | 0.0023 | 2026-08-07 | NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a use | |
CVE-2026-16695 |
high | 7.8 | 0.0021 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbit | |
CVE-2026-75056 |
high | 7.8 | 0.0019 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible | |
CVE-2026-16875 |
high | 7.8 | 0.0022 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary comm | |
CVE-2026-113722 |
high | 7.8 | 0.0029 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv | |
CVE-2026-113725 |
high | 7.8 | 0.0019 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.7, the bash a | |
CVE-2026-56838 |
high | 7.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI rec | |
CVE-2026-57142 |
high | 7.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI rec | |
CVE-2026-116576 |
high | 7.8 | 0.0014 | 2026-10-26 | systeminformation is a System and OS information library for node.js. Prior to 5.33.16, services() i | |
CVE-2026-115805 |
high | 7.8 | — | 2026-10-29 | Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow aut | |
CVE-2026-13162 |
high | 7.7 | 0.0019 | 2026-10-27 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain r | |
CVE-2025-40947 |
high | 7.7 | 0.0054 | 2026-05-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX | |
CVE-2026-46394 |
high | 7.7 | 0.0077 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS | |
CVE-2026-54699 |
high | 7.7 | 0.0074 | 2026-06-24 | Warp is an agentic development environment. From 0.2024.03.12.08.02.stable_01 until 0.2026.05.06.15. | |
CVE-2026-55607 |
high | 7.7 | 0.0069 | 2026-06-29 | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling a | |
CVE-2026-57999 |
high | 7.7 | 0.0147 | 2026-06-29 | luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RP | |
CVE-2026-60102 |
high | 7.7 | 0.0327 | 2026-07-08 | Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in t | |
CVE-2026-17347 |
high | 7.7 | 0.0072 | 2026-07-31 | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an ex | |
CVE-2026-73623 |
high | 7.7 | 0.0083 | 2026-08-13 | GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --tem | |
CVE-2026-68560 |
high | 7.7 | 0.0058 | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated | |
CVE-2026-84682 |
high | 7.7 | 0.0121 | 2026-10-01 | A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An | |
CVE-2026-75775 |
high | 7.7 | 0.0060 | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows rem | |
CVE-2026-119025 |
high | 7.7 | — | 2026-10-29 | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to exe | |
CVE-2026-58652 |
high | 7.7 | 0.0080 | 2026-07-02 | luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd se | |
CVE-2026-85168 |
high | 7.7 | 0.0083 | 2026-09-03 | n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in th | 1 PoC |
CVE-2026-6893 |
high | 7.5 | 0.0127 | 2026-06-10 | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability | |
CVE-2026-16445 |
high | 7.5 | 0.0322 | 2026-07-21 | A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability | |
CVE-2026-15816 |
high | 7.5 | 0.0047 | 2026-08-07 | A flaw was found in dracut. The die() error-handling function writes its message into a shell script | |
CVE-2026-111461 |
high | 7.5 | 0.0137 | 2026-10-27 | An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management fu | |
CVE-2026-4157 |
high | 7.5 | 0.0086 | 2026-04-11 | ChargePoint Home Flex revssh Service Command Injection Remote Code Execution Vulnerability. This vul | |
CVE-2026-7461 |
high | 7.5 | 0.0055 | 2026-04-30 | Improper neutralization of inputs used in an OS command in the FSx Windows File Server volume mounti | |
CVE-2026-43003 |
high | 7.5 | 0.0098 | 2026-05-01 | An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent ( | |
CVE-2026-46643 |
high | 7.5 | 0.0020 | 2026-06-10 | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Pr | |
CVE-2026-12398 |
high | 7.5 | 0.0089 | 2026-06-16 | A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the lega |