Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-44179 |
critical | 9.9 | — | 2026-10-28 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Conf | |
CVE-2026-64193 |
critical | 9.8 | 0.0144 | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. N | |
CVE-2026-47391 |
critical | 9.8 | 0.0150 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server | |
CVE-2026-48317 |
critical | 9.6 | 0.0094 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically | |
CVE-2026-44939 |
critical | 9.4 | 0.0128 | 2026-06-19 | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endpoint /v3/ | |
CVE-2026-69264 |
critical | 9.4 | 0.0111 | 2026-08-04 | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI | |
CVE-2026-44128 |
critical | 9.3 | 0.0085 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code execution i | |
CVE-2026-44643 |
critical | 9.3 | 0.0048 | 2026-05-11 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Pr | |
CVE-2026-47103 |
critical | 9.3 | 0.0136 | 2026-06-17 | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that | |
CVE-2026-69253 |
critical | 9.0 | 0.0066 | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. | |
CVE-2026-73601 |
critical | 9.0 | 0.0110 | 2026-08-13 | Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom MCP node w | |
CVE-2026-73602 |
critical | 9.0 | 0.0083 | 2026-08-13 | Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allo | |
CVE-2026-33618 |
high | 8.8 | 0.0032 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController | |
CVE-2026-40316 |
high | 8.8 | 0.0041 | 2026-04-15 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git | |
CVE-2026-42603 |
high | 8.8 | 0.0025 | 2026-05-11 | OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git | |
CVE-2026-14380 |
high | 8.8 | 0.0050 | 2026-07-07 | DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. | |
CVE-2026-67195 |
high | 8.7 | 0.0119 | 2026-08-04 | Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attacke | |
CVE-2026-22666 |
high | 8.6 | 0.1553 | 2026-04-07 | Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerabili | |
CVE-2026-42079 |
high | 8.6 | 0.0014 | 2026-05-04 | PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTA | |
CVE-2026-50733 |
high | 8.6 | 0.0067 | 2026-06-05 | Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown co | |
CVE-2026-45293 |
high | 8.6 | 0.0025 | 2026-07-28 | WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding | |
CVE-2026-73248 |
high | 8.5 | 0.0020 | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_templ | |
CVE-2026-79678 |
high | 8.1 | 0.0090 | 2026-09-07 | A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base- | |
CVE-2026-73231 |
high | 7.8 | 0.0021 | 2026-08-11 | Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker. | |
CVE-2026-55415 |
high | 7.5 | 0.0049 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-53875 |
high | 7.1 | 0.0055 | 2026-06-17 | picklescan before 1.0.3 contains a scanning bypass vulnerability in the scan_pytorch function that a | |
CVE-2026-39423 |
medium | 6.9 | 0.0017 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Inject | |
CVE-2026-5971 |
medium | 5.5 | 0.0039 | 2026-04-09 | A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the functi | |
CVE-2026-6652 |
low | 2.0 | 0.0024 | 2026-04-20 | A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate |