Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-41679 |
critical | 10.0 | 0.3167 | 2026-04-23 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. | |
CVE-2026-54067 |
critical | 9.9 | 0.0038 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body cont | |
CVE-2026-54158 |
critical | 9.9 | 0.0036 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (d | |
CVE-2026-55454 |
critical | 9.9 | 0.0060 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the bund | |
CVE-2026-46386 |
critical | 9.9 | 0.0049 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproje | |
CVE-2026-60024 |
critical | 9.8 | 0.0054 | 2026-07-17 | Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Jo | |
CVE-2026-47393 |
critical | 9.8 | 0.0058 | 2026-07-21 | PraisonAI is a multi-agent teams system. CVE-2026-44338 (GHSA-6rmh-7xcm-cpxj) documents that Praison | |
CVE-2026-16504 |
critical | 9.8 | 0.0048 | 2026-07-31 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a de | |
CVE-2026-39920 |
critical | 9.3 | 0.0054 | 2026-04-24 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administ | |
CVE-2026-67208 |
critical | 9.3 | 0.0722 | 2026-07-30 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remo | |
CVE-2026-75926 |
critical | 9.3 | 0.0028 | 2026-08-18 | Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code runnin | |
CVE-2026-25784 |
critical | 9.3 | 0.0034 | 2026-10-23 | Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (c | |
CVE-2026-62415 |
critical | 9.1 | 0.0045 | 2026-07-21 | Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Jo | |
CVE-2026-16503 |
critical | 9.1 | 0.0043 | 2026-07-31 | Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is publishe | |
CVE-2026-116672 |
high | 8.8 | 0.0027 | 2026-10-27 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, th | |
CVE-2026-6043 |
high | 8.8 | 0.0126 | 2026-04-24 | P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed | |
CVE-2026-43892 |
high | 8.8 | 0.0026 | 2026-05-12 | AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitiz | |
CVE-2026-32965 |
high | 8.7 | 0.0035 | 2026-04-20 | Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manag | |
CVE-2026-35672 |
high | 8.7 | 0.0048 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default | |
CVE-2026-61439 |
high | 8.7 | 0.0034 | 2026-07-11 | PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block | |
CVE-2026-9039 |
high | 8.6 | 0.0020 | 2026-05-28 | A configuration weakness in the device’s remote management service allows an authenticated session t | |
CVE-2026-62185 |
high | 8.6 | 0.0046 | 2026-07-13 | Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a | |
CVE-2026-104077 |
high | 8.5 | 0.0026 | 2026-10-08 | Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers | |
CVE-2026-104078 |
high | 8.4 | 0.0017 | 2026-10-08 | Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 S | |
CVE-2026-114397 |
high | 8.3 | 0.0059 | 2026-10-21 | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whene | |
CVE-2026-41432 |
high | 8.2 | 0.0085 | 2026-05-08 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys | |
CVE-2026-6866 |
high | 8.2 | 0.0029 | 2026-05-12 | CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause | |
CVE-2026-56285 |
high | 7.7 | 0.0046 | 2026-06-29 | Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and use | |
CVE-2026-50519 |
high | 7.5 | 0.0092 | 2026-06-19 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allow | |
CVE-2026-54066 |
high | 7.5 | 0.0217 | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-202 | |
CVE-2026-65881 |
high | 7.5 | 0.0042 | 2026-07-28 | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account acces | |
CVE-2026-114123 |
high | 7.5 | 0.0042 | 2026-10-21 | D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operation | |
CVE-2026-33376 |
high | 7.4 | 0.0028 | 2026-05-13 | When using an IPv6 allow-list for the Auth Proxy feature, it defaults to /32 addresses. Addresses sp | |
CVE-2026-10671 |
high | 7.1 | 0.0016 | 2026-07-14 | In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kerne | |
CVE-2026-27662 |
high | 7.0 | 0.0011 | 2026-05-12 | Affected devices do not properly restrict access to the web browser via the Control Panel when no co | |
CVE-2026-41931 |
medium | 6.9 | 0.0032 | 2026-05-06 | Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenti | |
CVE-2026-114618 |
medium | 6.8 | 0.0022 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the defau | |
CVE-2023-31101 |
medium | 6.5 | 0.0111 | 2023-05-22 | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLon | |
CVE-2025-41713 |
medium | 6.5 | 0.0037 | 2025-09-15 | During a short time frame while the device is booting an unauthenticated remote attacker can send tr | |
CVE-2026-118691 |
medium | 6.3 | 0.0031 | 2026-10-28 | xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send | |
CVE-2026-54800 |
medium | 6.3 | 0.0023 | 2026-07-09 | A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.2 | |
CVE-2026-9680 |
medium | 5.8 | 0.0040 | 2026-07-28 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers t | |
CVE-2026-33921 |
medium | 4.8 | 0.0013 | 2026-08-11 | The Windows installer deployed Npcap leaving its access restriction option at the insecure default v | |
CVE-2026-20265 |
medium | 4.3 | 0.0022 | 2026-06-17 | In Splunk AI Toolkit versions below 5.7.4, a low-privileged user that does not hold the "admin" or " | |
CVE-2026-0134 |
medium | 4.0 | 0.0008 | 2026-06-16 | In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset | |
CVE-2026-55708 |
low | 3.1 | 0.0016 | 2026-07-22 | In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'view_local_data' and 'view_local_datas' | |
CVE-2026-112255 |
low | 2.9 | — | 2026-10-29 | Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authenticat | |
CVE-2026-110952 |
— | — | 0.0012 | 2026-10-28 | A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed valida | |
CVE-2026-116273 |
— | — | 0.0018 | 2026-10-28 | MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, |