Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-56190 |
critical | 9.8 | 0.0097 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a | 1 PoC |
CVE-2026-97011 |
high | 8.8 | 0.0084 | 2026-10-13 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute c | |
CVE-2026-88150 |
high | 8.8 | 0.0076 | 2026-10-13 | Use of uninitialized resource in Microsoft Office Word allows an unauthorized attacker to execute co | |
CVE-2023-32213 |
high | 8.8 | 0.0075 | 2023-06-02 | When reading a file, an uninitialized value could have been used as read limit. This vulnerability a | |
CVE-2026-112897 |
high | 8.7 | 0.0048 | 2026-10-19 | Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory | |
CVE-2026-34543 |
high | 8.7 | 0.0050 | 2026-04-01 | OpenEXR provides the specification and reference implementation of the EXR file format, an image sto | |
CVE-2026-40364 |
high | 8.4 | 0.0442 | 2026-05-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an una | |
CVE-2026-116180 |
high | 8.3 | 0.0025 | 2026-10-25 | vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. LogprobsTensors.empty_cpu() in vllm/v1/o | |
CVE-2026-58051 |
high | 8.3 | 0.0028 | 2026-06-28 | libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new e | |
CVE-2026-55949 |
high | 7.8 | 0.0047 | 2026-07-14 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute c | |
CVE-2026-83669 |
high | 7.8 | 0.0043 | 2026-10-13 | Use of uninitialized resource in Windows Error Reporting allows an authorized attacker to elevate pr | |
CVE-2026-85843 |
high | 7.8 | 0.0037 | 2026-10-13 | Use of uninitialized resource in Windows Background Intelligent Transfer Service (BITS) allows an au | |
CVE-2026-63870 |
high | 7.8 | 0.0016 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accep | |
CVE-2026-83515 |
high | 7.5 | 0.0107 | 2026-10-13 | Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to disclose information | |
CVE-2026-85322 |
high | 7.5 | 0.0103 | 2026-10-13 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthor | |
CVE-2026-45736 |
high | 7.5 | 0.0075 | 2026-05-15 | ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() | |
CVE-2026-11576 |
high | 7.5 | 0.0046 | 2026-06-19 | The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP | |
CVE-2026-16384 |
high | 7.5 | 0.0043 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi | |
CVE-2026-16385 |
high | 7.5 | 0.0043 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi | |
CVE-2026-16386 |
high | 7.5 | 0.0043 | 2026-07-21 | Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi | |
CVE-2026-47247 |
high | 7.5 | 0.0048 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib | |
CVE-2026-19448 |
high | 7.5 | 0.0035 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the | |
CVE-2025-40829 |
high | 7.3 | 0.0020 | 2025-12-12 | A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applicat | |
CVE-2026-49165 |
high | 7.1 | 0.0034 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclo | |
CVE-2026-47272 |
high | 7.1 | 0.0012 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, t | |
CVE-2026-81038 |
high | 7.1 | 0.0015 | 2026-10-26 | The Object Transfer Service server builds its Object Action Control Point (OACP) response indication | |
CVE-2026-70459 |
medium | 6.9 | 0.0072 | 2026-08-13 | rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child proce | |
CVE-2026-104074 |
medium | 6.9 | 0.0031 | 2026-10-07 | Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthent | |
CVE-2026-50376 |
medium | 6.5 | 0.0092 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information | |
CVE-2026-50497 |
medium | 6.5 | 0.0092 | 2026-07-14 | Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose info | |
CVE-2026-55003 |
medium | 6.5 | 0.0092 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information | |
CVE-2026-57982 |
medium | 6.5 | 0.0100 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information o | |
CVE-2026-58533 |
medium | 6.5 | 0.0092 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information | |
CVE-2026-58535 |
medium | 6.5 | 0.0092 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information | |
CVE-2026-58546 |
medium | 6.5 | 0.0092 | 2026-07-14 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information | |
CVE-2026-97629 |
medium | 6.5 | 0.0023 | 2026-10-14 | Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name: | 1 PoC |
CVE-2026-114501 |
medium | 6.3 | 0.0037 | 2026-10-21 | Pillow is a Python imaging library. From 11.2.1 until 13.0.0, Arrow export assumes that an image's r | |
CVE-2026-109438 |
medium | 6.3 | 0.0036 | 2026-10-14 | 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory dis | |
CVE-2026-114651 |
medium | 6.3 | 0.0039 | 2026-10-22 | A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause | |
CVE-2026-16827 |
medium | 5.9 | 0.0044 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser | |
CVE-2026-63381 |
medium | 5.8 | 0.0016 | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after | |
CVE-2026-57083 |
medium | 5.5 | 0.0054 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to | |
CVE-2026-57084 |
medium | 5.5 | 0.0054 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose i | |
CVE-2026-62740 |
medium | 5.5 | 0.0040 | 2026-08-11 | Use of uninitialized resource in Windows Imaging Component allows an authorized attacker to disclose | |
CVE-2026-49424 |
medium | 5.5 | 0.0015 | 2026-08-19 | The Linux waitid() implementation translates a FreeBSD siginfo_t struct into a stack-declared Linux | |
CVE-2026-49425 |
medium | 5.5 | 0.0015 | 2026-08-19 | The compat32 kevent() handler translates a 64-bit kevent struct into a stack- declared 32-bit struct | |
CVE-2026-58084 |
medium | 5.5 | 0.0014 | 2026-08-19 | To retrieve the previous timer value, the kernel calls realtimer_gettime(), which obtains the curren | |
CVE-2026-70090 |
medium | 5.5 | 0.0046 | 2026-10-13 | Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose informat | |
CVE-2026-62709 |
medium | 5.5 | 0.0040 | 2026-08-11 | Use of uninitialized resource in Windows GDI+ allows an authorized attacker to disclose information | |
CVE-2026-68799 |
medium | 5.5 | 0.0054 | 2026-08-11 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose |