Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (837)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65770 |
critical | 10.0 | 0.0105 | 2026-08-20 | Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed | |
CVE-2026-57572 |
critical | 10.0 | 0.0094 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv | |
CVE-2026-111813 |
critical | 10.0 | 0.0049 | 2026-10-21 | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagic | |
CVE-2026-47365 |
critical | 9.9 | 0.0041 | 2026-06-12 | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows | |
CVE-2026-73294 |
critical | 9.9 | 0.0065 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, reposi | |
CVE-2026-90868 |
critical | 9.9 | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 | |
CVE-2026-22738 |
critical | 9.8 | 0.0111 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value | |
CVE-2026-73240 |
critical | 9.8 | 0.0104 | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects | |
CVE-2026-16770 |
critical | 9.8 | 0.0073 | 2026-08-13 | PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in | |
CVE-2026-44790 |
critical | 9.4 | 0.0053 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, an authen | |
CVE-2026-61459 |
critical | 9.3 | 0.0236 | 2026-07-10 | MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools | |
CVE-2026-112900 |
critical | 9.2 | 0.0130 | 2026-10-19 | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument inject | |
CVE-2026-53790 |
critical | 9.2 | 0.0063 | 2026-08-13 | rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attac | |
CVE-2026-44193 |
critical | 9.1 | 0.0069 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsen | |
CVE-2026-45158 |
critical | 9.1 | 0.0053 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input i | |
CVE-2026-40047 |
critical | 9.1 | 0.0243 | 2026-07-06 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in | |
CVE-2026-115372 |
critical | 9.0 | 0.0036 | 2026-10-22 | Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project u | |
CVE-2026-2449 |
critical | 9.0 | 0.0033 | 2026-04-14 | Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in | |
CVE-2026-92892 |
critical | 9.0 | 0.0034 | 2026-10-13 | Potential arbitrary code execution under specific configurations. Updated October 22, 2026: Affected | |
CVE-2026-90865 |
critical | 9.0 | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 | |
CVE-2026-14459 |
high | 8.8 | 0.0021 | 2026-07-03 | Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in | |
CVE-2026-72538 |
high | 8.8 | 0.0098 | 2026-08-11 | An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to | |
CVE-2024-58275 |
high | 8.7 | 0.0180 | 2025-12-04 | Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability i | |
CVE-2026-53783 |
high | 8.6 | 0.0037 | 2026-08-13 | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in | |
CVE-2026-4145 |
high | 8.5 | 0.0020 | 2026-04-15 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Software | |
CVE-2026-40938 |
high | 8.5 | 0.0079 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting | |
CVE-2026-52750 |
high | 8.4 | 0.0050 | 2026-06-10 | Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows | |
CVE-2026-46529 |
high | 8.4 | 0.0053 | 2026-06-10 | Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si | |
CVE-2026-12530 |
high | 8.4 | 0.0034 | 2026-06-17 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent | |
CVE-2026-16796 |
high | 8.4 | 0.0073 | 2026-07-23 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent | |
CVE-2026-75912 |
high | 8.3 | 0.0045 | 2026-08-18 | CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool t | |
CVE-2026-43893 |
high | 8.2 | 0.0049 | 2026-05-11 | exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-ven | |
CVE-2026-44712 |
high | 8.2 | 0.0015 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a | |
CVE-2026-40113 |
high | 8.1 | 0.0023 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, deploy.py constructs a single comma-delim | |
CVE-2026-39884 |
high | 8.1 | 0.0026 | 2026-04-15 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions | |
CVE-2026-97798 |
high | 7.8 | 0.0037 | 2026-10-13 | Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error | 2 PoC |
CVE-2026-0634 |
high | 7.8 | 0.0052 | 2026-04-02 | Code execution in AssistFeedbackService of TECNO Pova7 Pro 5G on Android allows local apps to execut | |
CVE-2026-41570 |
high | 7.8 | 0.0019 | 2026-05-08 | PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI set | |
CVE-2026-44189 |
high | 7.8 | 0.0095 | 2026-07-22 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider | |
CVE-2026-43698 |
high | 7.8 | 0.0022 | 2026-07-27 | An injection issue was addressed with improved validation. This issue is fixed in macOS Golden Gate | |
CVE-2026-18157 |
high | 7.8 | 0.0036 | 2026-07-31 | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the s | |
CVE-2026-50056 |
high | 7.8 | 0.0034 | 2026-10-23 | A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Sui | |
CVE-2026-47829 |
high | 7.7 | 0.0042 | 2026-07-09 | Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH option | |
CVE-2026-17347 |
high | 7.7 | 0.0072 | 2026-07-31 | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an ex | |
CVE-2026-49987 |
high | 7.5 | 0.0070 | 2026-07-15 | Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitC | |
CVE-2026-15793 |
high | 7.3 | 0.0020 | 2026-07-21 | BuildKit custom frontends or clients using the raw low-level API can set git.checkoutbundle=true whe | |
CVE-2026-119282 |
high | 7.3 | — | 2026-10-29 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 | |
CVE-2026-73624 |
high | 7.2 | 0.0055 | 2026-08-13 | GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.d | |
CVE-2026-4786 |
high | 7.0 | 0.0029 | 2026-04-13 | Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be by | |
CVE-2026-52817 |
high | 7.0 | 0.0018 | 2026-08-18 | Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. |