Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (837)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-22738 |
critical | 9.8 | 0.0111 | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value | |
CVE-2026-33943 |
critical | 9.8 | 0.0065 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In v | |
CVE-2026-11561 |
critical | 9.8 | 0.0045 | 2026-06-11 | Improper neutralization of special elements used in an expression language statement ('expression la | |
CVE-2026-52439 |
critical | 9.8 | 0.0068 | 2026-07-23 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.ne | |
CVE-2026-42811 |
critical | 9.4 | 0.0043 | 2026-05-04 | In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for o | |
CVE-2026-65591 |
high | 8.9 | 0.0069 | 2026-07-22 | n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member h | 1 PoC |
CVE-2026-108334 |
high | 7.4 | 0.0034 | 2026-10-15 | A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generat | |
CVE-2026-8759 |
medium | 5.5 | 0.0041 | 2026-05-17 | A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of th | |
CVE-2026-95664 |
medium | 5.4 | 0.0084 | 2026-10-26 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La | |
CVE-2021-44228 |
— | — | 1.0000 | — | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlle | KEV |
CVE-2026-33938 |
— | — | 0.0072 | 2026-03-27 | Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 thr | |
CVE-2026-40477 |
— | — | 0.0085 | 2026-04-17 | Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3. | |
CVE-2026-40478 |
— | — | 0.0110 | 2026-04-17 | Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3. | |
CVE-2026-40897 |
— | — | 0.0055 | 2026-04-24 | Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vul | |
CVE-2026-57281 |
— | — | 0.0092 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformat | |
CVE-2010-1871 |
— | — | 0.8340 | — | JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux | KEV |