Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42181 |
medium | 6.5 | 0.0026 | 2026-05-08 | Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches meta | |
CVE-2026-42175 |
medium | 6.5 | 0.0031 | 2026-05-12 | requests-hardened is a library that overrides the default behaviors of the requests library, and add | |
CVE-2026-47157 |
medium | 6.5 | 0.0019 | 2026-06-11 | aiograpi is an asynchronous Instagram API for Python. aiograpi versions before 0.9.10 accepted serve | |
CVE-2026-49359 |
medium | 6.5 | 0.0042 | 2026-06-19 | PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version | |
CVE-2026-54033 |
medium | 6.5 | 0.0035 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, Libr | |
CVE-2026-10546 |
medium | 6.5 | 0.0025 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 contains a Server-Side Request Forgery (SSRF) vulnerability in | |
CVE-2026-58418 |
medium | 6.5 | 0.0031 | 2026-07-03 | SSRF via HTTP Redirect in Repository Migration | |
CVE-2026-49876 |
medium | 6.5 | 0.0049 | 2026-07-13 | Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and | |
CVE-2026-7754 |
medium | 6.5 | 0.0034 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) | |
CVE-2026-13192 |
medium | 6.5 | 0.0042 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted | |
CVE-2026-65618 |
medium | 6.5 | 0.0035 | 2026-07-27 | Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, t | |
CVE-2026-65924 |
medium | 6.5 | 0.0041 | 2026-07-27 | JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Si | |
CVE-2026-65925 |
medium | 6.5 | 0.0040 | 2026-07-27 | A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request uni | |
CVE-2026-7657 |
medium | 6.5 | 0.0037 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to | |
CVE-2026-16637 |
medium | 6.5 | 0.0046 | 2026-08-07 | OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the A | |
CVE-2026-72560 |
medium | 6.5 | 0.0034 | 2026-08-11 | A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists b | |
CVE-2026-72597 |
medium | 6.5 | 0.0034 | 2026-08-11 | A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authe | |
CVE-2026-72598 |
medium | 6.5 | 0.0037 | 2026-08-11 | A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role | |
CVE-2026-73560 |
medium | 6.5 | 0.0041 | 2026-08-17 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMu | |
CVE-2026-17557 |
medium | 6.5 | 0.0033 | 2026-10-21 | A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated | |
CVE-2026-55190 |
medium | 6.5 | 0.0026 | 2026-10-23 | Event Schedule is an open-source platform to share events, sell tickets and bring communities togeth | |
CVE-2026-115886 |
medium | 6.5 | 0.0068 | 2026-10-23 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-116680 |
medium | 6.4 | 0.0019 | 2026-10-27 | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates gene | |
CVE-2026-40346 |
medium | 6.4 | 0.0038 | 2026-04-18 | NocoBase is an AI-powered no-code/low-code platform for building business applications and enterpris | |
CVE-2026-47268 |
medium | 6.4 | 0.0022 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-13318 |
medium | 6.4 | 0.0024 | 2026-06-26 | A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. Whe | |
CVE-2026-56026 |
medium | 6.4 | 0.0023 | 2026-06-26 | Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions. | |
CVE-2026-57681 |
medium | 6.4 | 0.0023 | 2026-07-02 | Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions. | |
CVE-2026-57413 |
medium | 6.4 | 0.0023 | 2026-07-13 | Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows | |
CVE-2026-56678 |
medium | 6.4 | 0.0021 | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /ap | |
CVE-2026-67530 |
medium | 6.4 | 0.0026 | 2026-07-30 | WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhoo | |
CVE-2026-72768 |
medium | 6.4 | 0.0040 | 2026-08-11 | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in | |
CVE-2026-108360 |
medium | 6.4 | 0.0022 | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1 | |
CVE-2026-24231 |
medium | 6.3 | 0.0013 | 2026-04-28 | NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, whe | |
CVE-2026-42180 |
medium | 6.3 | 0.0018 | 2026-05-08 | Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy allows an au | |
CVE-2026-44430 |
medium | 6.3 | 0.0029 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. | |
CVE-2026-48858 |
medium | 6.3 | 0.0023 | 2026-06-10 | Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP | |
CVE-2026-53782 |
medium | 6.3 | 0.0026 | 2026-06-11 | Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers w | |
CVE-2026-12726 |
medium | 6.3 | 0.0033 | 2026-06-19 | A flaw was found in the AWX GitHub webhook integration. When processing GitHub pull_request webhooks | |
CVE-2026-56769 |
medium | 6.3 | 0.0037 | 2026-06-25 | Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request | |
CVE-2026-56771 |
medium | 6.3 | 0.0035 | 2026-06-25 | NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url e | |
CVE-2026-57947 |
medium | 6.3 | 0.0033 | 2026-06-29 | Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registrat | |
CVE-2026-50134 |
medium | 6.3 | 0.0040 | 2026-07-06 | Hugo is a static site generator. From 0.91.0 until 0.162.0, resources.GetRemote enforces security.ht | |
CVE-2026-58478 |
medium | 6.3 | 0.0038 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery | |
CVE-2026-61520 |
medium | 6.3 | 0.0044 | 2026-07-14 | Simple Machines Forum 2.1 prior to commit b4d23df (fixed in 2.1.8) and 3.0 prior to commit 4bf35cf c | |
CVE-2026-61646 |
medium | 6.3 | 0.0036 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF g | |
CVE-2026-63731 |
medium | 6.3 | 0.0030 | 2026-07-20 | HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated | |
CVE-2026-65593 |
medium | 6.3 | 0.0024 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request forgery vulnerability | |
CVE-2026-17192 |
medium | 6.3 | 0.0029 | 2026-07-27 | A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on | |
CVE-2026-54205 |
medium | 6.3 | 0.0049 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm) |