Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40351 |
critical | 9.8 | 0.0063 | 2026-04-17 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login en | |
CVE-2026-8649 |
critical | 9.8 | 0.0046 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Tra | |
CVE-2026-41274 |
critical | 9.3 | 0.0050 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-45688 |
critical | 9.1 | 0.0049 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-45689 |
critical | 9.1 | 0.0053 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-40352 |
high | 8.8 | 0.0038 | 2026-04-17 | FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoin | |
CVE-2026-47181 |
high | 8.7 | 0.0031 | 2026-06-11 | PenguinMod-BackendApi is the backend api for penguinmod. Prior to version 1.0.0, a NoSQL injection v | |
CVE-2026-73618 |
high | 8.7 | 0.0036 | 2026-08-13 | Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query executio | |
CVE-2026-63637 |
high | 8.6 | 0.0041 | 2026-08-06 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.8, maybeQuoteArg in graphql/res | |
CVE-2026-46591 |
high | 8.2 | 0.0055 | 2026-07-06 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J | |
CVE-2026-33980 |
high | 8.1 | 0.0040 | 2026-03-27 | Azure Data Explorer MCP Server is a Model Context Protocol (MCP) server that enables AI assistants t | |
CVE-2026-47835 |
high | 7.5 | 0.0030 | 2026-06-15 | In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary que | |
CVE-2026-44840 |
high | 7.5 | 0.0053 | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPasswo | |
CVE-2026-10698 |
high | 7.2 | 0.0064 | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Tra | |
CVE-2026-114648 |
high | 7.2 | 0.0032 | 2026-10-22 | The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names | |
CVE-2026-42156 |
high | 7.1 | 0.0035 | 2026-05-12 | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, tr | |
CVE-2026-73617 |
high | 7.1 | 0.0034 | 2026-08-13 | Budibase before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB datasource integratio | |
CVE-2026-114396 |
high | 7.1 | 0.0048 | 2026-10-21 | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authent | |
CVE-2026-114510 |
high | 7.1 | 0.0024 | 2026-10-22 | Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applic | |
CVE-2026-114652 |
high | 7.1 | 0.0030 | 2026-10-22 | A data-query-logic neutralization weakness in the update-statement construction component of the Mon | |
CVE-2026-118645 |
high | 7.0 | 0.0023 | 2026-10-28 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnera | |
CVE-2026-57193 |
medium | 6.9 | 0.0196 | 2026-10-26 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-118581 |
medium | 6.9 | 0.0019 | 2026-10-28 | A BSON encoding component of the MongoDB Java Driver does not verify that an externally supplied raw | |
CVE-2026-118641 |
medium | 6.9 | 0.0030 | 2026-10-28 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection | |
CVE-2026-114401 |
medium | 6.9 | 0.0044 | 2026-10-21 | Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthentic | |
CVE-2026-48121 |
medium | 6.7 | 0.0036 | 2026-08-04 | @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that | |
CVE-2026-59962 |
medium | 6.5 | 0.0034 | 2026-10-16 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-55369 |
medium | 6.5 | 0.0026 | 2026-10-28 | Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /a | |
CVE-2026-42316 |
medium | 6.5 | 0.0034 | 2026-05-11 | kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer ( | |
CVE-2026-76327 |
medium | 6.4 | 0.0026 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway ve | |
CVE-2026-85167 |
medium | 6.3 | 0.0040 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsea | |
CVE-2026-116801 |
medium | 5.3 | 0.0025 | 2026-10-27 | Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object refe | |
CVE-2026-114647 |
medium | 5.3 | 0.0026 | 2026-10-22 | The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a | |
CVE-2026-55444 |
medium | 5.3 | 0.0025 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-55465 |
medium | 5.3 | 0.0026 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-33566 |
medium | 5.1 | 0.0018 | 2026-04-27 | There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event | |
CVE-2026-49482 |
medium | 4.3 | 0.0020 | 2026-06-12 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #141, ClipBucket v5 | |
CVE-2026-76295 |
medium | 4.3 | 0.0027 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway v | |
CVE-2026-6626 |
low | 2.1 | 0.0023 | 2026-04-20 | A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unkn | |
CVE-2026-70395 |
low | 2.1 | 0.0020 | 2026-08-09 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash all |