Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-33976 |
critical | 9.6 | 0.0072 | 2026-03-27 | Notesnook is a note-taking app. Prior to version 3.3.11 on Web/Desktop and 3.3.17 on Android/iOS, a | |
CVE-2026-42090 |
critical | 9.6 | 0.0048 | 2026-05-04 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook Web/Desktop | |
CVE-2026-44482 |
critical | 9.6 | 0.0034 | 2026-05-14 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock sup | |
CVE-2026-45311 |
critical | 9.6 | 0.0057 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool ex | |
CVE-2026-45374 |
critical | 9.6 | 0.0039 | 2026-05-28 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawn | |
CVE-2026-10789 |
critical | 9.6 | 0.0070 | 2026-06-22 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the M | |
CVE-2026-48519 |
critical | 9.6 | 0.0078 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the " | |
CVE-2026-33646 |
critical | 9.6 | 0.0046 | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes . | |
CVE-2026-14453 |
critical | 9.6 | 0.0084 | 2026-07-13 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centreon-open-t | |
CVE-2026-71319 |
critical | 9.6 | 0.0063 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (developm | |
CVE-2026-6875 |
critical | 9.5 | 0.0143 | 2026-07-13 | ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow | |
CVE-2026-70477 |
critical | 9.5 | 0.0081 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-77992 |
critical | 9.5 | 0.0044 | 2026-08-22 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 | |
CVE-2025-30050 |
critical | 9.4 | 0.0022 | 2026-10-23 | CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports t | |
CVE-2026-104383 |
critical | 9.4 | 0.0037 | 2026-10-28 | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2 | |
CVE-2026-41137 |
critical | 9.4 | 0.0145 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-44262 |
critical | 9.4 | 0.0586 | 2026-05-12 | Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, when docume | |
CVE-2026-45833 |
critical | 9.4 | 0.0034 | 2026-06-12 | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a | |
CVE-2026-55413 |
critical | 9.4 | 0.0032 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tool | |
CVE-2026-61444 |
critical | 9.4 | 0.0050 | 2026-07-10 | PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the a | |
CVE-2026-69254 |
critical | 9.4 | 0.0069 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-69256 |
critical | 9.4 | 0.0101 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-69259 |
critical | 9.4 | 0.0082 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-69264 |
critical | 9.4 | 0.0111 | 2026-08-04 | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI | |
CVE-2026-73032 |
critical | 9.4 | 0.0056 | 2026-08-11 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e | |
CVE-2026-66147 |
critical | 9.4 | 0.0176 | 2026-08-11 | An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G | |
CVE-2024-58351 |
critical | 9.3 | 0.0093 | 2026-06-20 | Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the | |
CVE-2021-48016 |
critical | 9.3 | 0.0044 | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP R | |
CVE-2026-8634 |
critical | 9.3 | 0.0095 | 2026-05-14 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allows attacke | |
CVE-2026-45261 |
critical | 9.3 | 0.0052 | 2026-05-28 | GitButler is a modern Git-based version control interface for AI-powered workflows. Prior to 0.19.7, | |
CVE-2026-47103 |
critical | 9.3 | 0.0136 | 2026-06-17 | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that | |
CVE-2026-58116 |
critical | 9.3 | 0.0090 | 2026-06-30 | LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit | |
CVE-2026-58138 |
critical | 9.3 | 0.0914 | 2026-06-30 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit | |
CVE-2026-58449 |
critical | 9.3 | 0.0135 | 2026-06-30 | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose function body | |
CVE-2026-12257 |
critical | 9.3 | 0.0070 | 2026-07-13 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. | |
CVE-2026-59865 |
critical | 9.3 | 0.0436 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota info` read | |
CVE-2026-59866 |
critical | 9.3 | 0.0141 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms | |
CVE-2026-65008 |
critical | 9.3 | 0.0249 | 2026-07-21 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData | |
CVE-2026-68770 |
critical | 9.3 | 0.0091 | 2026-07-31 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achi | |
CVE-2026-18667 |
critical | 9.3 | 0.0072 | 2026-08-03 | A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privi | |
CVE-2026-70553 |
critical | 9.3 | 0.0127 | 2026-08-04 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to | |
CVE-2026-67531 |
critical | 9.3 | 0.0073 | 2026-08-06 | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). Prior to 1.5.7, the s | |
CVE-2026-75827 |
critical | 9.3 | 0.0086 | 2026-08-18 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare | |
CVE-2026-63146 |
critical | 9.3 | 0.0066 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, atta | |
CVE-2026-114053 |
critical | 9.2 | 0.0046 | 2026-10-21 | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Tra | |
CVE-2026-39918 |
critical | 9.2 | 0.0066 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where th | |
CVE-2026-13014 |
critical | 9.2 | 0.0070 | 2026-07-13 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated | |
CVE-2026-69255 |
critical | 9.2 | 0.0060 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-58256 |
critical | 9.1 | 0.0057 | 2026-10-27 | GRR is a resource management and reservation application. Prior to the advisory-reported fixed versi | |
CVE-2026-67074 |
critical | 9.1 | 0.0046 | 2026-10-28 | HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to exec |