Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-75839 |
medium | 5.3 | 0.0031 | 2026-08-18 | ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object referen | |
CVE-2026-70911 |
medium | 5.3 | 0.0034 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-70974 |
medium | 5.3 | 0.0028 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-71087 |
medium | 5.3 | 0.0034 | 2026-08-18 | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX | |
CVE-2026-76390 |
medium | 5.3 | 0.0039 | 2026-08-19 | In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated u | |
CVE-2026-91153 |
medium | 5.3 | 0.0061 | 2026-10-29 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin fo | |
CVE-2026-112954 |
medium | 5.3 | 0.0044 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST AP | |
CVE-2026-109934 |
medium | 5.3 | 0.0028 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publi | |
CVE-2026-109935 |
medium | 5.3 | 0.0028 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions whe | |
CVE-2026-113490 |
medium | 5.3 | 0.0028 | 2026-10-24 | The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check whe | |
CVE-2026-113492 |
medium | 5.3 | 0.0028 | 2026-10-24 | The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password che | |
CVE-2026-111976 |
medium | 5.3 | 0.0020 | 2026-10-25 | The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when re | |
CVE-2026-116282 |
medium | 5.3 | 0.0034 | 2026-10-26 | A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function C | |
CVE-2026-116283 |
medium | 5.3 | 0.0028 | 2026-10-26 | A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file / | |
CVE-2026-116284 |
medium | 5.3 | 0.0033 | 2026-10-26 | A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknow | |
CVE-2026-114270 |
medium | 5.3 | 0.0015 | 2026-10-29 | The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rend | |
CVE-2026-115282 |
medium | 5.3 | 0.0015 | 2026-10-29 | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check be | |
CVE-2026-78396 |
medium | 5.3 | 0.0015 | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the | |
CVE-2026-92086 |
medium | 5.3 | — | 2026-10-29 | The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions | |
CVE-2026-113693 |
medium | 5.3 | — | 2026-10-29 | Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Managemen | |
CVE-2026-91248 |
medium | 5.3 | 0.0032 | 2026-10-20 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime | |
CVE-2026-113706 |
medium | 5.1 | 0.0025 | 2026-10-21 | A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of | |
CVE-2026-42213 |
medium | 5.1 | 0.0056 | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCA | |
CVE-2026-34087 |
medium | 5.1 | 0.0027 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OAT | |
CVE-2026-58024 |
medium | 5.1 | 0.0037 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med | |
CVE-2026-101384 |
medium | 5.0 | 0.0028 | 2026-10-20 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected | |
CVE-2026-91640 |
medium | 5.0 | 0.0024 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-91641 |
medium | 5.0 | 0.0024 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-91652 |
medium | 5.0 | 0.0025 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-34244 |
medium | 5.0 | 0.0025 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit pe | |
CVE-2026-41610 |
medium | 5.0 | 0.0060 | 2026-05-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studi | |
CVE-2026-91631 |
medium | 5.0 | 0.0030 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-87366 |
medium | 4.9 | 0.0038 | 2026-10-20 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: We | |
CVE-2026-8058 |
medium | 4.9 | 0.0036 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a p | |
CVE-2026-71085 |
medium | 4.9 | 0.0040 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-83381 |
medium | 4.8 | 0.0023 | 2026-10-20 | Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Ora | |
CVE-2026-87343 |
medium | 4.8 | 0.0021 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Port | |
CVE-2026-87385 |
medium | 4.8 | 0.0022 | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edward | |
CVE-2026-33448 |
medium | 4.8 | 0.0010 | 2026-04-30 | CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client fo | |
CVE-2026-34090 |
medium | 4.8 | 0.0028 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Che | |
CVE-2026-70590 |
medium | 4.8 | 0.0032 | 2026-08-04 | Ghost is a Node.js content management system. Prior to 6.54.1, any staff-level user was able to leak | |
CVE-2026-116281 |
medium | 4.8 | 0.0010 | 2026-10-26 | A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the func | |
CVE-2026-70869 |
medium | 4.7 | 0.0020 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Inte | |
CVE-2026-12311 |
medium | 4.7 | 0.0019 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerabi | |
CVE-2026-91629 |
medium | 4.7 | 0.0010 | 2026-10-20 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communic | |
CVE-2023-27465 |
medium | 4.6 | 0.0028 | 2023-06-13 | A vulnerability has been identified in SIMOTION C240 (All versions >= V5.4 < V5.5 SP1), SIMOTION C24 | |
CVE-2026-30613 |
medium | 4.6 | 0.0017 | 2026-04-06 | An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch (16amp)- WiFi/Bluetooth | |
CVE-2026-12620 |
medium | 4.6 | 0.0039 | 2026-06-19 | The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. | |
CVE-2026-101843 |
medium | 4.5 | 0.0011 | 2026-10-20 | Vulnerability in the Production Scheduling product of Oracle E-Business Suite (component: Internal O | |
CVE-2026-87350 |
medium | 4.5 | 0.0011 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Secu |