Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (542)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-116479 |
medium | 5.3 | 0.0032 | 2026-10-26 | A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage | |
CVE-2026-116805 |
medium | 5.3 | 0.0022 | 2026-10-27 | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level proje | |
CVE-2026-118272 |
medium | 5.3 | 0.0025 | 2026-10-28 | A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext | |
CVE-2026-103372 |
medium | 5.3 | 0.0026 | 2026-10-28 | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order | |
CVE-2026-107100 |
medium | 5.3 | 0.0026 | 2026-10-28 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested po | |
CVE-2026-110509 |
medium | 5.3 | 0.0025 | 2026-10-28 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or | |
CVE-2026-118578 |
medium | 5.3 | 0.0022 | 2026-10-28 | A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected el | |
CVE-2026-40063 |
medium | 5.3 | 0.0029 | 2026-10-29 | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (ve | |
CVE-2026-117688 |
medium | 5.3 | 0.0027 | 2026-10-29 | A flaw was found in the client registration component of Keycloak, an open-source identity and acces | |
CVE-2026-50415 |
medium | 5.3 | 0.0086 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an unauthorized a | |
CVE-2025-40941 |
medium | 5.3 | 0.0028 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected devices | |
CVE-2026-20027 |
medium | 5.3 | 0.0060 | 2026-01-07 | Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that c | |
CVE-2026-33761 |
medium | 5.3 | 0.0040 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json | |
CVE-2026-40151 |
medium | 5.3 | 0.0076 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the AgentOS deployment platform exposes a | |
CVE-2026-33888 |
medium | 5.3 | 0.0051 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-39857 |
medium | 5.3 | 0.0043 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-40908 |
medium | 5.3 | 0.0025 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at | |
CVE-2026-21999 |
medium | 5.3 | 0.0024 | 2026-04-21 | Vulnerability in the XML Database component of Oracle Database Server. Supported versions that are | |
CVE-2026-34273 |
medium | 5.3 | 0.0025 | 2026-04-21 | Vulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are | |
CVE-2026-41182 |
medium | 5.3 | 0.0021 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0. | |
CVE-2026-42878 |
medium | 5.3 | 0.0090 | 2026-05-27 | FacturaScripts is an open source accounting and invoicing software. Prior to v2026, an unauthenticat | |
CVE-2026-49397 |
medium | 5.3 | 0.0031 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-46790 |
medium | 5.3 | 0.0034 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-53923 |
medium | 5.3 | 0.0048 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0 | |
CVE-2026-53949 |
medium | 5.3 | 0.0036 | 2026-06-24 | Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to fi | |
CVE-2026-14049 |
medium | 5.3 | 0.0026 | 2026-06-30 | Inappropriate implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-58027 |
medium | 5.3 | 0.0037 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Abu | |
CVE-2026-58033 |
medium | 5.3 | 0.0041 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med | |
CVE-2026-14611 |
medium | 5.3 | 0.0043 | 2026-07-03 | A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function i | |
CVE-2026-56298 |
medium | 5.3 | 0.0031 | 2026-07-08 | Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the app information endp | |
CVE-2026-6801 |
medium | 5.3 | 0.0036 | 2026-07-11 | The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions | |
CVE-2026-56456 |
medium | 5.3 | 0.0040 | 2026-07-16 | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dash | |
CVE-2026-47751 |
medium | 5.3 | 0.0077 | 2026-07-16 | Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests | |
CVE-2026-58149 |
medium | 5.3 | 0.0034 | 2026-07-17 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens | |
CVE-2026-56584 |
medium | 5.3 | 0.0029 | 2026-07-21 | HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identi | |
CVE-2026-60156 |
medium | 5.3 | 0.0034 | 2026-07-21 | Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1, 2 | |
CVE-2026-60237 |
medium | 5.3 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60260 |
medium | 5.3 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60283 |
medium | 5.3 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Suppor | |
CVE-2026-60394 |
medium | 5.3 | 0.0034 | 2026-07-21 | Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that ar | |
CVE-2026-60611 |
medium | 5.3 | 0.0034 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (compone | |
CVE-2026-60888 |
medium | 5.3 | 0.0031 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal | |
CVE-2026-61050 |
medium | 5.3 | 0.0031 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Use | |
CVE-2026-62490 |
medium | 5.3 | 0.0031 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Int | |
CVE-2026-66489 |
medium | 5.3 | 0.0035 | 2026-07-29 | Joomla Extension - balbooa.com - Various unauthenticated file system disclosure in Gridbox < 2.20.2 | |
CVE-2026-48078 |
medium | 5.3 | 0.0034 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-72760 |
medium | 5.3 | 0.0038 | 2026-08-10 | Affected versions of MISP cti-transmute disclose users' email addresses through the account followin | |
CVE-2026-72549 |
medium | 5.3 | 0.0048 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticat | |
CVE-2026-18673 |
medium | 5.3 | 0.0046 | 2026-08-12 | When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, i | |
CVE-2026-68520 |
medium | 5.3 | 0.0040 | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in |