Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-61564 |
critical | 10.0 | 0.0054 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/ | |
CVE-2026-39337 |
critical | 10.0 | 0.0072 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication re | |
CVE-2026-40911 |
critical | 10.0 | 0.0065 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's Web | |
CVE-2026-26332 |
critical | 10.0 | 0.0071 | 2026-05-04 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attack | |
CVE-2026-41900 |
critical | 10.0 | 0.0091 | 2026-05-08 | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3 | |
CVE-2026-42288 |
critical | 10.0 | 0.0072 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is | |
CVE-2026-45829 |
critical | 10.0 | 0.1515 | 2026-05-18 | A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python | |
CVE-2026-52704 |
critical | 10.0 | 0.0031 | 2026-06-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P | |
CVE-2026-48836 |
critical | 10.0 | 0.0057 | 2026-06-15 | Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | |
CVE-2026-25470 |
critical | 10.0 | 0.0065 | 2026-06-17 | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for WordPress < | |
CVE-2026-10561 |
critical | 10.0 | 0.0082 | 2026-06-22 | IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python exe | |
CVE-2026-53753 |
critical | 10.0 | 0.0290 | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expres | |
CVE-2026-53576 |
critical | 10.0 | 0.0330 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authe | |
CVE-2026-10134 |
critical | 10.0 | 0.0232 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langfl | |
CVE-2026-57624 |
critical | 10.0 | 0.0086 | 2026-07-02 | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. | |
CVE-2026-57572 |
critical | 10.0 | 0.0094 | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv | |
CVE-2026-61447 |
critical | 10.0 | 0.1524 | 2026-07-11 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in CodeAgent._execute_python( | |
CVE-2026-57811 |
critical | 10.0 | 0.0056 | 2026-07-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic | |
CVE-2026-44359 |
critical | 10.0 | 0.0180 | 2026-07-20 | Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtast | |
CVE-2026-8984 |
critical | 10.0 | 0.0091 | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via | |
CVE-2026-65906 |
critical | 10.0 | 0.0066 | 2026-07-23 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was po | |
CVE-2026-65880 |
critical | 10.0 | 0.0077 | 2026-07-28 | Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An | |
CVE-2026-64633 |
critical | 10.0 | 0.0060 | 2026-08-04 | A vulnerability allowing remote unauthenticated code execution on the agent host. | |
CVE-2026-65553 |
critical | 10.0 | 0.0086 | 2026-08-06 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 | |
CVE-2026-66915 |
critical | 10.0 | 0.0082 | 2026-08-10 | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attac | |
CVE-2026-58231 |
critical | 10.0 | 0.0086 | 2026-08-11 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and s | |
CVE-2026-45618 |
critical | 10.0 | 0.0082 | 2026-08-11 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possi | |
CVE-2026-67282 |
critical | 10.0 | 0.0078 | 2026-08-12 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.6.8 - An unaut | |
CVE-2026-73299 |
critical | 10.0 | 0.0178 | 2026-08-12 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the T | |
CVE-2026-27544 |
critical | 10.0 | 0.0086 | 2026-08-13 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |
CVE-2026-61962 |
critical | 10.0 | 0.0069 | 2026-08-13 | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | |
CVE-2026-74253 |
critical | 10.0 | 0.0032 | 2026-08-17 | Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in | |
CVE-2026-73343 |
critical | 10.0 | 0.0086 | 2026-08-18 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | |
CVE-2026-76604 |
critical | 10.0 | 0.0070 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabr | |
CVE-2026-76605 |
critical | 10.0 | 0.0070 | 2026-08-22 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | |
CVE-2026-61991 |
critical | 10.0 | — | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | |
CVE-2026-104351 |
critical | 9.9 | 0.0057 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti | |
CVE-2026-40342 |
critical | 9.9 | 0.0069 | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 | |
CVE-2026-39440 |
critical | 9.9 | 0.0036 | 2026-04-23 | Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFor | |
CVE-2026-41512 |
critical | 9.9 | 0.0059 | 2026-05-08 | ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version | |
CVE-2026-42898 |
critical | 9.9 | 0.0119 | 2026-05-12 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) al | |
CVE-2026-49774 |
critical | 9.9 | 0.0028 | 2026-06-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al | |
CVE-2026-46850 |
critical | 9.9 | 0.0052 | 2026-06-17 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The suppo | |
CVE-2026-40783 |
critical | 9.9 | 0.0054 | 2026-06-17 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. | |
CVE-2026-5366 |
critical | 9.9 | 0.0103 | 2026-06-20 | Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-contr | |
CVE-2026-54823 |
critical | 9.9 | 0.0079 | 2026-06-25 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. | |
CVE-2026-7873 |
critical | 9.9 | 0.0155 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS command | |
CVE-2026-48614 |
critical | 9.9 | 0.0058 | 2026-07-06 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject | |
CVE-2026-46512 |
critical | 9.9 | 0.0065 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply ac | |
CVE-2026-9135 |
critical | 9.9 | 0.0084 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163 |