Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-87337 |
critical | 10.0 | 0.0044 | 2026-10-20 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-21515 |
critical | 9.9 | 0.0070 | 2026-04-24 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized | |
CVE-2026-55500 |
critical | 9.9 | 0.0048 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows f | |
CVE-2026-60552 |
critical | 9.9 | 0.0043 | 2026-07-21 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-52855 |
critical | 9.9 | 0.0051 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. | |
CVE-2026-57116 |
critical | 9.8 | 0.0027 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's Ag | |
CVE-2025-11710 |
critical | 9.8 | 0.0042 | 2025-10-14 | A compromised web process using malicious IPC messages could have caused the privileged browser proc | |
CVE-2026-41492 |
critical | 9.8 | 0.0308 | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process | |
CVE-2026-43992 |
critical | 9.8 | 0.0022 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write | |
CVE-2026-16387 |
critical | 9.8 | 0.0028 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firef | |
CVE-2026-60264 |
critical | 9.8 | 0.0055 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60551 |
critical | 9.8 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-60555 |
critical | 9.8 | 0.0051 | 2026-07-21 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-61233 |
critical | 9.8 | 0.0051 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (c | |
CVE-2026-64874 |
critical | 9.8 | 0.0052 | 2026-07-23 | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN creden | |
CVE-2026-54489 |
critical | 9.8 | 0.0062 | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a | |
CVE-2026-87347 |
critical | 9.6 | 0.0038 | 2026-10-20 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module) | |
CVE-2026-55447 |
critical | 9.6 | 0.0066 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by co | |
CVE-2026-71424 |
critical | 9.6 | 0.0049 | 2026-08-17 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers | |
CVE-2026-63190 |
critical | 9.4 | — | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior | |
CVE-2026-46395 |
critical | 9.3 | 0.0029 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `h | |
CVE-2026-46912 |
critical | 9.3 | 0.0027 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Run | |
CVE-2026-55450 |
critical | 9.3 | 0.0119 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unaut | |
CVE-2026-61175 |
critical | 9.3 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: I | |
CVE-2026-7166 |
critical | 9.2 | 0.0054 | 2026-06-22 | Vulnerability involving the exposure of sensitive data provided without adequate protection. The API | |
CVE-2026-65760 |
critical | 9.2 | 0.0042 | 2026-07-23 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy | |
CVE-2026-70478 |
critical | 9.2 | 0.0062 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-54203 |
critical | 9.2 | 0.0056 | 2026-08-07 | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allow | |
CVE-2026-72804 |
critical | 9.2 | 0.0043 | 2026-08-12 | SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph e | |
CVE-2026-17060 |
critical | 9.1 | 0.0071 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info | |
CVE-2026-7381 |
critical | 9.1 | 0.0044 | 2026-04-29 | Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewri | |
CVE-2026-25199 |
critical | 9.1 | 0.0050 | 2026-05-08 | Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to oth | |
CVE-2026-45091 |
critical | 9.1 | 0.0033 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. | |
CVE-2026-46910 |
critical | 9.1 | 0.0035 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr | |
CVE-2026-44231 |
critical | 9.1 | 0.0025 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6 | |
CVE-2026-59503 |
critical | 9.1 | 0.0043 | 2026-08-13 | : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Informat | |
CVE-2026-54305 |
high | 8.9 | 0.0037 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE | |
CVE-2026-47025 |
high | 8.8 | 0.0045 | 2026-10-20 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versi | |
CVE-2026-87359 |
high | 8.8 | 0.0045 | 2026-10-20 | Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supp | |
CVE-2026-57102 |
high | 8.8 | 0.0082 | 2026-07-14 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize | |
CVE-2026-61426 |
high | 8.8 | 0.0040 | 2026-07-11 | PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with | |
CVE-2026-42017 |
high | 8.8 | 0.0052 | 2026-07-27 | An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a | |
CVE-2026-83943 |
high | 8.7 | 0.0054 | 2026-10-08 | Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorize | |
CVE-2026-117604 |
high | 8.7 | 0.0031 | 2026-10-27 | Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAu | |
CVE-2026-41278 |
high | 8.7 | 0.0042 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-14161 |
high | 8.7 | 0.0055 | 2026-06-30 | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo | |
CVE-2026-56226 |
high | 8.7 | 0.0032 | 2026-07-08 | Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6( | |
CVE-2026-57219 |
high | 8.7 | 0.0284 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsol | |
CVE-2026-61454 |
high | 8.7 | 0.0031 | 2026-07-11 | The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable | |
CVE-2026-56238 |
high | 8.7 | 0.0047 | 2026-07-12 | Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST glo |