Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-11362 |
critical | 9.8 | 0.0045 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog: | |
CVE-2026-72590 |
critical | 9.8 | 0.0204 | 2026-08-10 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthentic | |
CVE-2026-116231 |
critical | 9.4 | 0.0044 | 2026-10-26 | A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. The impacted element is an unkn | |
CVE-2026-116232 |
critical | 9.4 | 0.0044 | 2026-10-26 | A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set o | |
CVE-2026-116233 |
critical | 9.4 | 0.0046 | 2026-10-26 | A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown | |
CVE-2026-116234 |
critical | 9.4 | 0.0046 | 2026-10-26 | A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the | |
CVE-2026-116235 |
critical | 9.4 | 0.0061 | 2026-10-26 | A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown | |
CVE-2026-116237 |
critical | 9.3 | 0.0035 | 2026-10-26 | A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the compo | |
CVE-2026-9270 |
critical | 9.1 | 0.0033 | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does | |
CVE-2026-50638 |
critical | 9.1 | 0.0034 | 2026-06-10 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injec | |
CVE-2026-11373 |
critical | 9.1 | 0.0057 | 2026-06-22 | Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Clien | |
CVE-2026-35517 |
high | 8.8 | 0.0086 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web inte | |
CVE-2026-35518 |
high | 8.8 | 0.0070 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web inte | |
CVE-2026-35519 |
high | 8.8 | 0.0054 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web inte | |
CVE-2026-35520 |
high | 8.8 | 0.0070 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web inte | |
CVE-2026-35521 |
high | 8.8 | 0.0069 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web inte | |
CVE-2026-5140 |
high | 8.8 | 0.0048 | 2026-04-29 | Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Softwar | |
CVE-2026-6351 |
high | 8.7 | 0.0059 | 2026-04-16 | MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticat | |
CVE-2026-32993 |
high | 8.3 | 0.0030 | 2026-05-13 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allo | |
CVE-2026-46720 |
high | 8.2 | 0.0034 | 2026-05-17 | Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections. The metric names and se | |
CVE-2026-50637 |
high | 8.2 | 0.0032 | 2026-06-10 | Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectio | |
CVE-2026-41570 |
high | 7.8 | 0.0019 | 2026-05-08 | PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI set | |
CVE-2026-55603 |
high | 7.5 | 0.0029 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequest | |
CVE-2026-111221 |
high | 7.5 | 0.0094 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authen | |
CVE-2026-8788 |
high | 7.3 | 0.0023 | 2026-05-18 | Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the s | |
CVE-2026-72913 |
high | 7.3 | 0.0021 | 2026-08-10 | Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS ha | |
CVE-2026-12357 |
high | 7.2 | 0.0109 | 2026-07-29 | Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. | |
CVE-2026-42586 |
high | 7.1 | 0.0022 | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1. | |
CVE-2026-113386 |
high | 7.1 | 0.0100 | 2026-10-20 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A rem | |
CVE-2026-114720 |
high | 7.1 | 0.0081 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vuln | |
CVE-2026-32964 |
medium | 6.9 | 0.0028 | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CR | |
CVE-2026-49130 |
medium | 6.9 | 0.0026 | 2026-05-28 | Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the xspf | |
CVE-2026-50188 |
medium | 6.9 | 0.0044 | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins | |
CVE-2026-53788 |
medium | 6.9 | 0.0027 | 2026-08-13 | rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping | |
CVE-2026-71573 |
medium | 6.9 | 0.0034 | 2026-08-18 | Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An | |
CVE-2026-53533 |
medium | 6.9 | 0.0053 | 2026-08-18 | aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rc | |
CVE-2026-44217 |
medium | 6.6 | 0.0048 | 2026-05-12 | sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. | |
CVE-2026-46719 |
medium | 6.5 | 0.0031 | 2026-05-16 | Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections. The metric names were n | |
CVE-2026-50639 |
medium | 6.5 | 0.0026 | 2026-06-10 | Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric inject | |
CVE-2026-118371 |
medium | 6.3 | 0.0014 | 2026-10-28 | LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() a | |
CVE-2026-118372 |
medium | 6.3 | 0.0014 | 2026-10-28 | LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to in | |
CVE-2026-43968 |
medium | 6.3 | 0.0027 | 2026-05-11 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allow | |
CVE-2026-57511 |
medium | 6.3 | 0.0040 | 2026-07-28 | SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated | |
CVE-2026-110835 |
medium | 6.3 | 0.0026 | 2026-10-14 | FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a lone LF in the targe | |
CVE-2026-47240 |
medium | 5.8 | 0.0083 | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to | |
CVE-2026-47242 |
medium | 5.8 | 0.0018 | 2026-06-22 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to | |
CVE-2026-1502 |
medium | 5.7 | 0.0056 | 2026-04-10 | CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. | |
CVE-2026-2400 |
medium | 5.3 | 0.0023 | 2026-04-14 | CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could | |
CVE-2026-49214 |
medium | 5.3 | 0.0019 | 2026-06-11 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Versions prior to 2.10.2 did | |
CVE-2026-50629 |
medium | 5.3 | 0.0044 | 2026-06-12 | The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log |