Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-44359 |
critical | 10.0 | 0.0180 | 2026-07-20 | Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtast | |
CVE-2026-66902 |
critical | 9.8 | 0.0070 | 2026-08-04 | Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JS | |
CVE-2026-40154 |
critical | 9.6 | 0.0030 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetched templat | |
CVE-2026-13751 |
critical | 9.6 | 0.0020 | 2026-06-29 | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed ser | |
CVE-2026-47172 |
critical | 9.5 | 0.0041 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-47174 |
critical | 9.5 | 0.0039 | 2026-06-11 | In Duck Site before version 1.0.1, the repository has a deploy workflow that runs after the build wo | |
CVE-2026-58116 |
critical | 9.3 | 0.0090 | 2026-06-30 | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit | |
CVE-2026-50562 |
critical | 9.3 | 0.0021 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c | |
CVE-2026-59864 |
critical | 9.3 | 0.0133 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` | |
CVE-2026-59865 |
critical | 9.3 | 0.0436 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read | |
CVE-2026-118762 |
critical | 9.3 | — | 2026-10-29 | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/workflows/f | |
CVE-2026-40313 |
critical | 9.1 | 0.0031 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows | |
CVE-2026-40903 |
critical | 9.1 | 0.0024 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerabil | |
CVE-2026-71471 |
critical | 9.0 | 0.0122 | 2026-08-12 | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub clust | |
CVE-2026-57102 |
high | 8.8 | 0.0082 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize | |
CVE-2026-6859 |
high | 8.8 | 0.0044 | 2026-04-22 | A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when | |
CVE-2026-86949 |
high | 8.8 | 0.0015 | 2026-10-20 | This issue was addressed by enforcing library validation on the affected binaries. This issue is fix | |
CVE-2026-116843 |
high | 8.7 | 0.0043 | 2026-10-27 | Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to ru | |
CVE-2024-32011 |
high | 8.7 | 0.0042 | 2025-11-11 | A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2). The af | |
CVE-2026-42089 |
high | 8.6 | 0.0017 | 2026-06-16 | Yeoman Environment provides an API to discover, create, and run generators, and to configure where a | |
CVE-2026-40501 |
high | 8.6 | 0.0080 | 2026-07-15 | Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code executio | |
CVE-2026-65908 |
high | 8.6 | 0.0019 | 2026-07-23 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executabl | |
CVE-2026-67623 |
high | 8.6 | 0.0106 | 2026-08-05 | Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to e | |
CVE-2023-7357 |
high | 8.6 | — | 2026-10-29 | A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user | |
CVE-2026-6482 |
high | 8.5 | 0.0018 | 2026-04-17 | The Rapid7 Insight Agent (versions > 4.1.0.2) is vulnerable to a local privilege escalation attack t | |
CVE-2026-7373 |
high | 8.5 | 0.0017 | 2026-05-15 | Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gai | |
CVE-2026-65119 |
high | 8.4 | 0.0016 | 2026-10-27 | NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loadin | |
CVE-2026-46529 |
high | 8.4 | 0.0053 | 2026-06-10 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si | |
CVE-2026-44688 |
high | 8.4 | 0.0051 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory | |
CVE-2026-44691 |
high | 8.4 | 0.0041 | 2026-06-18 | In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/t | |
CVE-2026-46580 |
high | 8.4 | 0.0051 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a | |
CVE-2026-57860 |
high | 8.4 | 0.0021 | 2026-07-17 | ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the M | |
CVE-2026-64804 |
high | 8.4 | 0.0019 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr | |
CVE-2026-64805 |
high | 8.4 | 0.0019 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr | |
CVE-2026-64806 |
high | 8.4 | 0.0019 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project tr | |
CVE-2026-64808 |
high | 8.4 | 0.0019 | 2026-07-23 | In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project tr | |
CVE-2026-64809 |
high | 8.4 | 0.0019 | 2026-07-23 | In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project tr | |
CVE-2026-47781 |
high | 8.4 | 0.0019 | 2026-08-04 | PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automati | |
CVE-2026-114727 |
high | 8.3 | 0.0033 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageM | |
CVE-2026-44358 |
high | 8.2 | 0.0018 | 2026-05-28 | Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitH | |
CVE-2026-45711 |
high | 8.2 | 0.0039 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump - | |
CVE-2026-84725 |
high | 8.1 | 0.0034 | 2026-10-28 | when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs | |
CVE-2026-47398 |
high | 8.1 | 0.0050 | 2026-07-21 | PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-443 | |
CVE-2026-76139 |
high | 8.0 | 0.0072 | 2026-08-19 | A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a s | |
CVE-2026-87695 |
high | 7.8 | 0.0029 | 2026-10-13 | Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an auth | |
CVE-2026-59172 |
high | 7.8 | 0.0016 | 2026-10-28 | Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --l | |
CVE-2026-59176 |
high | 7.8 | 0.0021 | 2026-10-28 | Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functy | |
CVE-2026-54981 |
high | 7.8 | 0.0047 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension al | |
CVE-2026-40156 |
high | 7.8 | 0.0021 | 2026-04-10 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI automatically loads a file name | |
CVE-2026-12057 |
high | 7.8 | 0.0013 | 2026-06-15 | When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails |