Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-6437 |
medium | 6.9 | 0.0056 | 2026-04-17 | Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Drive | |
CVE-2026-109966 |
medium | 6.9 | 0.0041 | 2026-10-13 | yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated | |
CVE-2026-35153 |
medium | 6.7 | 0.0022 | 2026-04-17 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release | |
CVE-2026-25690 |
medium | 6.5 | 0.0024 | 2026-05-12 | An improper neutralization of argument delimiters in a command ('argument injection') vulnerability | |
CVE-2026-44968 |
medium | 6.3 | 0.0021 | 2026-07-16 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, _run_dbt_comma | |
CVE-2025-40948 |
medium | 6.1 | 0.0040 | 2026-05-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX | |
CVE-2026-47250 |
medium | 6.1 | 0.0042 | 2026-06-11 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to | |
CVE-2026-11968 |
medium | 5.5 | 0.0018 | 2026-06-24 | Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary File W | |
CVE-2026-73621 |
medium | 5.3 | 0.0036 | 2026-08-13 | GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, w | |
CVE-2026-71212 |
medium | 4.4 | 0.0016 | 2026-08-05 | xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner. | |
CVE-2026-54686 |
medium | 4.3 | 0.0040 | 2026-06-24 | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15. | |
CVE-2026-7725 |
low | 2.1 | 0.0025 | 2026-05-04 | A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unk | |
CVE-2026-8773 |
low | 2.0 | 0.0024 | 2026-05-18 | A security vulnerability has been detected in linlinjava litemall up to 1.8.0. Affected by this vuln | |
CVE-2026-24061 |
— | — | 0.9898 | — | GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote au | KEV |
CVE-2026-12856 |
— | — | 0.0055 | 2026-06-29 | A flaw was found in the vscode-java extension, which provides Java language support for Visual Studi | |
CVE-2026-86060 |
— | — | 0.0639 | — | MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerabil | KEV |