Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-64807 |
high | 7.8 | 0.0019 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied lin | |
CVE-2026-64811 |
high | 7.8 | 0.0019 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting proje | |
CVE-2026-55522 |
high | 7.8 | 0.0022 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions 3.9.26 through 4.6.57 of praiseonai and 0.12.12 | |
CVE-2026-96237 |
high | 7.5 | 0.0064 | 2026-10-13 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to | |
CVE-2026-43003 |
high | 7.5 | 0.0098 | 2026-05-01 | An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent ( | |
CVE-2026-22283 |
high | 7.5 | 0.0021 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from U | |
CVE-2026-114488 |
high | 7.4 | 0.0034 | 2026-10-29 | A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as | |
CVE-2026-15564 |
high | 7.4 | 0.0012 | 2026-10-29 | Wildfly's IIOP listener may permit deserialization of input streams before authentication is perform | |
CVE-2026-70267 |
high | 7.2 | 0.0101 | 2026-10-13 | Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an au | |
CVE-2026-42510 |
high | 7.2 | 0.0057 | 2026-04-28 | OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a c | |
CVE-2026-73367 |
high | 7.2 | 0.0033 | 2026-08-18 | Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | |
CVE-2026-59867 |
high | 7.1 | 0.0239 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved Ope | |
CVE-2026-85355 |
high | 7.0 | 0.0028 | 2026-10-13 | Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver al | |
CVE-2026-111357 |
high | 7.0 | 0.0025 | 2026-10-15 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache co | |
CVE-2026-54532 |
medium | 6.9 | 0.0019 | 2026-10-22 | CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_r | |
CVE-2026-22551 |
medium | 6.7 | 0.0031 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI response | |
CVE-2026-62902 |
medium | 6.5 | 0.0087 | 2026-08-11 | Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to | |
CVE-2026-24226 |
medium | 6.3 | 0.0016 | 2026-07-14 | NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper contro | |
CVE-2026-73851 |
medium | 6.1 | 0.0227 | 2026-08-17 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who co | |
CVE-2026-44312 |
medium | 5.8 | 0.0015 | 2026-05-14 | css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTT | |
CVE-2026-113461 |
medium | 5.2 | 0.0012 | 2026-10-21 | Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle c | |
CVE-2026-54325 |
medium | 4.4 | 0.0016 | 2026-06-23 | Pi is a minimal terminal coding harness. Pi before 0.79.0 loaded project-local configuration and res | |
CVE-2026-66843 |
low | 2.3 | 0.0051 | 2026-08-06 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrre | |
CVE-2026-115802 |
low | 2.1 | 0.0029 | 2026-10-24 | A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train o | |
CVE-2026-16085 |
low | 1.9 | 0.0016 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function | |
CVE-2026-15519 |
low | 1.3 | 0.0035 | 2026-07-13 | A vulnerability was found in usestrix strix up to 1.0.2. This affects an unknown function of the fil | |
CVE-2026-0770 |
— | — | 0.6256 | — | Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that all | KEV |
CVE-2026-43999 |
— | — | 0.0097 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be byp |