Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-8481 |
critical | 9.9 | 0.0088 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the | |
CVE-2026-8635 |
critical | 9.9 | 0.0059 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser | |
CVE-2026-59543 |
critical | 9.9 | 0.0079 | 2026-07-23 | Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions. | |
CVE-2026-13435 |
critical | 9.9 | 0.0053 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the Pyt | |
CVE-2026-12946 |
critical | 9.9 | 0.0063 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the | |
CVE-2026-65548 |
critical | 9.9 | 0.0079 | 2026-08-06 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. | |
CVE-2026-73268 |
critical | 9.9 | 0.0088 | 2026-08-12 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant | |
CVE-2026-32444 |
critical | 9.9 | 0.0079 | 2026-08-18 | Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. | |
CVE-2026-53942 |
critical | 9.9 | 0.0032 | 2026-10-23 | Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commi | |
CVE-2026-115188 |
critical | 9.9 | 0.0073 | 2026-10-26 | An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When pr | |
CVE-2026-107328 |
critical | 9.9 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitra | 1 PoC |
CVE-2026-107329 |
critical | 9.9 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitra | 1 PoC |
CVE-2024-11080 |
critical | 9.8 | 0.0081 | 2026-09-05 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticat | |
CVE-2024-31026 |
critical | 9.8 | 0.0075 | 2026-09-29 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker | |
CVE-2026-116692 |
critical | 9.8 | 0.0070 | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2019-15598 |
critical | 9.8 | 0.0274 | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker | |
CVE-2026-33943 |
critical | 9.8 | 0.0065 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In v | |
CVE-2026-40288 |
critical | 9.8 | 0.0061 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of prais | |
CVE-2026-30993 |
critical | 9.8 | 0.0052 | 2026-04-15 | Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in t | |
CVE-2026-33608 |
critical | 9.8 | 0.0038 | 2026-04-22 | An attacker can send a notify request that causes a new secondary domain to be added to the bind bac | |
CVE-2026-3960 |
critical | 9.8 | 0.0094 | 2026-04-23 | A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/I | |
CVE-2025-63706 |
critical | 9.8 | 0.0152 | 2026-05-07 | NPM package next-npm-version1.0.1 is vulnerable to Command injection. | |
CVE-2026-41507 |
critical | 9.8 | 0.0039 | 2026-05-08 | math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal co | |
CVE-2025-65719 |
critical | 9.8 | 0.0058 | 2026-05-12 | An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a vi | |
CVE-2026-44717 |
critical | 9.8 | 0.0048 | 2026-05-15 | MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy library. | |
CVE-2026-44887 |
critical | 9.8 | 0.0054 | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Aler | |
CVE-2026-44888 |
critical | 9.8 | 0.0039 | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Aler | |
CVE-2026-54133 |
critical | 9.8 | 0.0044 | 2026-06-12 | jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem | |
CVE-2026-9072 |
critical | 9.8 | 0.0072 | 2026-06-22 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intellige | |
CVE-2026-10109 |
critical | 9.8 | 0.0086 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due | |
CVE-2026-52200 |
critical | 9.8 | 0.0093 | 2026-07-08 | An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar | |
CVE-2026-38450 |
critical | 9.8 | 0.0104 | 2026-07-14 | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitra | |
CVE-2026-9198 |
critical | 9.8 | 0.2866 | 2026-07-17 | Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve fu | KEV |
CVE-2026-52656 |
critical | 9.8 | 0.0073 | 2026-07-20 | An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C an | |
CVE-2026-64815 |
critical | 9.8 | 0.0048 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form | |
CVE-2026-17561 |
critical | 9.8 | 0.0056 | 2026-07-31 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecom | |
CVE-2026-51785 |
critical | 9.8 | 0.0115 | 2026-07-31 | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary co | |
CVE-2026-71278 |
critical | 9.8 | 0.0066 | 2026-08-05 | rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_ | |
CVE-2026-42537 |
critical | 9.8 | 0.0129 | 2026-08-10 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgr | |
CVE-2026-44416 |
critical | 9.8 | 0.0124 | 2026-08-10 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apach | |
CVE-2026-55799 |
critical | 9.8 | 0.0122 | 2026-08-10 | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are | |
CVE-2026-73649 |
critical | 9.8 | 0.0073 | 2026-08-13 | Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, t | |
CVE-2026-50772 |
critical | 9.8 | 0.0068 | 2026-08-17 | An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via | |
CVE-2026-67960 |
critical | 9.8 | 0.0073 | 2026-08-17 | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController. | |
CVE-2026-38165 |
critical | 9.8 | 0.0087 | 2026-08-17 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration | |
CVE-2026-67919 |
critical | 9.8 | 0.0093 | 2026-08-17 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.ja | |
CVE-2026-77647 |
critical | 9.8 | 0.0229 | 2026-08-20 | SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited i | |
CVE-2026-104339 |
critical | 9.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to | |
CVE-2026-110186 |
critical | 9.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to | |
CVE-2026-48360 |
critical | 9.6 | 0.0045 | 2026-10-27 | Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerabil |