Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-35436 |
high | 8.8 | 0.0022 | 2026-05-12 | Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally. | |
CVE-2026-40365 |
high | 8.8 | 0.0096 | 2026-05-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to ex | |
CVE-2024-21962 |
high | 8.6 | 0.0011 | 2026-05-15 | Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary me | |
CVE-2026-57202 |
high | 8.1 | 0.0044 | 2026-10-27 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-50502 |
high | 8.0 | 0.0065 | 2026-07-14 | Insufficient granularity of access control in Windows Event Logging Service allows an authorized att | |
CVE-2026-70218 |
high | 7.8 | 0.0035 | 2026-10-13 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attac | |
CVE-2026-81969 |
high | 7.8 | 0.0034 | 2026-10-13 | Insufficient granularity of access control in Windows Server Update Service allows an authorized att | |
CVE-2026-83499 |
high | 7.8 | 0.0034 | 2026-10-13 | Insufficient granularity of access control in Windows Server Update Service allows an authorized att | |
CVE-2026-62721 |
high | 7.8 | 0.0030 | 2026-08-11 | Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized at | |
CVE-2026-48581 |
high | 7.8 | 0.0030 | 2026-07-14 | Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to ele | |
CVE-2026-49170 |
high | 7.8 | 0.0030 | 2026-07-14 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attac | |
CVE-2026-50405 |
high | 7.8 | 0.0030 | 2026-07-14 | Insufficient granularity of access control in Windows Filtering Platform (WFP) allows an authorized | |
CVE-2026-55006 |
high | 7.8 | 0.0030 | 2026-07-14 | Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacke | |
CVE-2026-56155 |
high | 7.8 | 0.0035 | 2026-07-14 | Microsoft Active Directory Federation Services contains an insufficient granularity of access contro | KEV |
CVE-2026-40145 |
high | 7.1 | 0.0015 | 2026-08-17 | A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deploymen | |
CVE-2026-68868 |
medium | 6.5 | 0.0060 | 2026-08-12 | The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied th | |
CVE-2026-70216 |
medium | 5.5 | 0.0034 | 2026-10-13 | Insufficient granularity of access control in Windows Mobile Device Management allows an authorized | |
CVE-2026-96372 |
medium | 5.4 | 0.0024 | 2026-10-22 | Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing. | |
CVE-2026-38743 |
medium | 4.3 | 0.0035 | 2026-04-24 | The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the- | |
CVE-2026-40690 |
medium | 4.3 | 0.0035 | 2026-04-24 | The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with | |
CVE-2026-37981 |
medium | 4.3 | 0.0037 | 2026-05-19 | A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lo | |
CVE-2026-14615 |
low | 2.7 | 0.0038 | 2026-07-03 | A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's ad | |
CVE-2026-33825 |
— | — | 0.0675 | — | Microsoft Defender contains an insufficient granularity of access control vulnerability that could a | KEV |
CVE-2026-6388 |
— | — | 0.0036 | 2026-04-15 | A flaw was found in ArgoCD Image Updater. This vulnerability allows an attacker, with permissions to | |
CVE-2026-40981 |
— | — | 0.0043 | 2026-05-07 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft |