Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-115889 |
critical | 9.9 | 0.0045 | 2026-10-23 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend b | |
CVE-2026-40446 |
critical | 9.8 | 0.0023 | 2026-04-13 | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source E | |
CVE-2026-13776 |
critical | 9.8 | 0.0035 | 2026-06-30 | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com | |
CVE-2026-64608 |
critical | 9.8 | 0.0081 | 2026-07-21 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deseria | |
CVE-2026-16355 |
critical | 9.8 | 0.0060 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox | |
CVE-2026-16363 |
critical | 9.8 | 0.0064 | 2026-07-21 | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox | |
CVE-2026-16410 |
critical | 9.8 | 0.0055 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox | |
CVE-2026-64704 |
critical | 9.8 | 0.0059 | 2026-07-27 | A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Seq | |
CVE-2026-71558 |
critical | 9.8 | 0.0099 | 2026-08-07 | Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache For | |
CVE-2026-59940 |
critical | 9.8 | 0.0081 | 2026-08-18 | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap | |
CVE-2026-16919 |
critical | 9.8 | 0.0080 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod | |
CVE-2026-13883 |
critical | 9.6 | 0.0041 | 2026-06-30 | Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potenti | |
CVE-2026-14423 |
critical | 9.6 | 0.0038 | 2026-07-01 | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentia | |
CVE-2026-17687 |
critical | 9.6 | 0.0056 | 2026-07-30 | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had co | |
CVE-2026-17697 |
critical | 9.6 | 0.0054 | 2026-07-30 | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potenti | |
CVE-2026-16392 |
critical | 9.1 | 0.0053 | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox | |
CVE-2026-58289 |
critical | 9.0 | 0.0199 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all | |
CVE-2026-58592 |
high | 8.9 | 0.0055 | 2026-07-01 | Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw in its WebAssembly E | |
CVE-2026-112659 |
high | 8.8 | 0.0056 | 2026-10-26 | A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 27 | |
CVE-2026-85898 |
high | 8.8 | 0.0077 | 2026-10-27 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all | |
CVE-2026-72984 |
high | 8.8 | 0.0082 | 2026-08-28 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all | |
CVE-2026-65807 |
high | 8.8 | 0.0082 | 2026-08-11 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an un | |
CVE-2026-102203 |
high | 8.8 | 0.0085 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized | |
CVE-2026-102869 |
high | 8.8 | 0.0084 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an un | |
CVE-2026-70167 |
high | 8.8 | 0.0098 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized att | |
CVE-2026-83642 |
high | 8.8 | 0.0093 | 2026-10-13 | Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized a | |
CVE-2023-28162 |
high | 8.8 | 0.0070 | 2023-06-02 | While implementing AudioWorklets, some code may have casted one type to another, invalid, dynamic ty | |
CVE-2026-6301 |
high | 8.8 | 0.0037 | 2026-04-15 | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to exe | |
CVE-2026-6307 |
high | 8.8 | 0.0037 | 2026-04-15 | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to exe | |
CVE-2026-6363 |
high | 8.8 | 0.0029 | 2026-04-15 | Type Confusion in V8 in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potential | |
CVE-2026-7927 |
high | 8.8 | 0.0029 | 2026-05-06 | Type Confusion in Runtime in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execu | |
CVE-2026-7988 |
high | 8.8 | 0.0031 | 2026-05-06 | Type Confusion in WebRTC in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execut | |
CVE-2026-8540 |
high | 8.8 | 0.0031 | 2026-05-14 | Type Confusion in V8 in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute a | |
CVE-2026-0162 |
high | 8.8 | 0.0023 | 2026-06-16 | In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. | |
CVE-2026-13967 |
high | 8.8 | 0.0049 | 2026-06-30 | Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to exec | |
CVE-2026-14431 |
high | 8.8 | 0.0050 | 2026-07-01 | Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute ar | |
CVE-2026-55772 |
high | 8.8 | 0.0048 | 2026-07-13 | CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained | |
CVE-2026-55771 |
high | 8.8 | 0.0057 | 2026-07-13 | CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained | |
CVE-2026-15776 |
high | 8.8 | 0.0050 | 2026-07-14 | Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacke | |
CVE-2026-16420 |
high | 8.8 | 0.0057 | 2026-07-21 | Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to exe | |
CVE-2026-17725 |
high | 8.8 | 0.0045 | 2026-07-30 | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar | |
CVE-2026-17989 |
high | 8.8 | 0.0045 | 2026-07-30 | Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar | |
CVE-2026-76038 |
high | 8.8 | 0.0045 | 2026-08-18 | Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute a | |
CVE-2026-76047 |
high | 8.8 | 0.0045 | 2026-08-18 | Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute a | |
CVE-2026-106433 |
high | 8.7 | 0.0026 | 2026-10-08 | Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as | |
CVE-2026-114598 |
high | 8.7 | 0.0030 | 2026-10-27 | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a | |
CVE-2026-44628 |
high | 8.7 | 0.0064 | 2026-06-30 | An unauthenticated attacker can crash the worklist server with a single crafted query when the serve | |
CVE-2026-40364 |
high | 8.4 | 0.0442 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an una | |
CVE-2026-12390 |
high | 8.4 | 0.0019 | 2026-06-18 | In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by a | |
CVE-2026-58285 |
high | 8.3 | 0.0061 | 2026-07-03 | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) all |