Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-50629 |
medium | 5.3 | 0.0044 | 2026-06-12 | The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log | |
CVE-2026-39958 |
medium | 5.2 | 0.0036 | 2026-04-09 | oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metada | |
CVE-2026-35504 |
medium | 5.1 | 0.0027 | 2026-05-12 | PowerSYSTEM Center email notification service is affected by a CRLF injection vulnerability when usi | |
CVE-2026-15429 |
medium | 5.1 | 0.0139 | 2026-07-14 | A privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v | |
CVE-2026-55766 |
medium | 4.8 | 0.0023 | 2026-06-23 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/p | |
CVE-2026-71572 |
medium | 4.8 | 0.0024 | 2026-08-18 | Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0 | |
CVE-2026-34975 |
medium | 4.3 | 0.0019 | 2026-04-06 | Plunk is an open-source email platform built on top of AWS SES. Prior to 0.8.0, a CRLF header inject | |
CVE-2026-43882 |
medium | 4.3 | 0.0021 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthentica | |
CVE-2026-115785 |
medium | 4.3 | 0.0073 | 2026-10-23 | An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collabora | |
CVE-2026-35601 |
medium | 4.1 | 0.0020 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output ge | |
CVE-2026-115303 |
low | 3.7 | 0.0022 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-v | |
CVE-2026-50269 |
low | 2.7 | 0.0053 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att | |
CVE-2026-43969 |
low | 2.1 | 0.0015 | 2026-05-11 | Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in ninenines cowlib allow | |
CVE-2026-65636 |
low | 2.1 | 0.0020 | 2026-07-31 | Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) all | |
CVE-2026-113715 |
low | 2.0 | 0.0024 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib | |
CVE-2025-61884 |
— | — | 0.9589 | — | Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime c | KEV |
CVE-2026-39983 |
— | — | 0.0219 | 2026-04-09 | basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via C | |
CVE-2026-57281 |
— | — | 0.0092 | 2026-06-24 | Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformat |