Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-28976 |
high | 7.5 | 0.0030 | 2026-05-11 | An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe | |
CVE-2026-40379 |
high | 7.5 | 0.0091 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized | |
CVE-2026-45332 |
high | 7.5 | 0.0142 | 2026-05-28 | Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-be | |
CVE-2026-50870 |
high | 7.5 | 0.0038 | 2026-06-15 | An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1 | |
CVE-2026-47633 |
high | 7.5 | 0.0103 | 2026-06-18 | Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experience | |
CVE-2026-37453 |
high | 7.5 | 0.0054 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attac | |
CVE-2026-37454 |
high | 7.5 | 0.0034 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attac | |
CVE-2026-37452 |
high | 7.5 | 0.0053 | 2026-06-25 | Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attac | |
CVE-2026-57231 |
high | 7.5 | 0.0044 | 2026-06-26 | Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image tha | |
CVE-2026-47193 |
high | 7.5 | 0.0031 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j | |
CVE-2026-9836 |
high | 7.5 | 0.0045 | 2026-06-30 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure | |
CVE-2026-24451 |
high | 7.5 | 0.0045 | 2026-07-03 | Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public t | |
CVE-2026-25038 |
high | 7.5 | 0.0062 | 2026-07-03 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | |
CVE-2026-58419 |
high | 7.5 | 0.0038 | 2026-07-03 | Notification API leaks private issue metadata after access revocation | |
CVE-2026-46726 |
high | 7.5 | 0.0086 | 2026-07-06 | Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R | |
CVE-2026-53598 |
high | 7.5 | 0.0129 | 2026-07-16 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders | |
CVE-2026-16354 |
high | 7.5 | 0.0046 | 2026-07-21 | Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox | |
CVE-2026-16373 |
high | 7.5 | 0.0037 | 2026-07-21 | Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed | |
CVE-2026-16374 |
high | 7.5 | 0.0044 | 2026-07-21 | Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firef | |
CVE-2026-16391 |
high | 7.5 | 0.0044 | 2026-07-21 | Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox | |
CVE-2026-16398 |
high | 7.5 | 0.0022 | 2026-07-21 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thun | |
CVE-2026-16400 |
high | 7.5 | 0.0043 | 2026-07-21 | Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 a | |
CVE-2026-16405 |
high | 7.5 | 0.0044 | 2026-07-21 | Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Fire | |
CVE-2026-47247 |
high | 7.5 | 0.0048 | 2026-07-21 | libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib | |
CVE-2026-60167 |
high | 7.5 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (c | |
CVE-2026-60554 |
high | 7.5 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-61116 |
high | 7.5 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component | |
CVE-2026-61133 |
high | 7.5 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Applicat | |
CVE-2026-61159 |
high | 7.5 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-65430 |
high | 7.5 | 0.0042 | 2026-07-23 | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credent | |
CVE-2026-65881 |
high | 7.5 | 0.0042 | 2026-07-28 | Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account acces | |
CVE-2026-55389 |
high | 7.5 | 0.0055 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-55390 |
high | 7.5 | 0.0055 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.6 | |
CVE-2026-61891 |
high | 7.5 | 0.0053 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP f | |
CVE-2026-60023 |
high | 7.5 | 0.0062 | 2026-08-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This iss | |
CVE-2026-61899 |
high | 7.5 | 0.0071 | 2026-08-10 | Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to downlo | |
CVE-2026-72548 |
high | 7.5 | 0.0061 | 2026-08-11 | An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticat | |
CVE-2026-73246 |
high | 7.5 | 0.0060 | 2026-08-11 | Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/s | |
CVE-2026-52481 |
high | 7.5 | 0.0052 | 2026-08-18 | An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensiti | |
CVE-2026-60393 |
high | 7.5 | 0.0044 | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component | |
CVE-2026-73878 |
high | 7.5 | 0.0044 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-73883 |
high | 7.5 | 0.0044 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-73884 |
high | 7.5 | 0.0044 | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). | |
CVE-2026-52021 |
high | 7.5 | 0.0049 | 2026-08-20 | An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitiv | |
CVE-2025-61164 |
high | 7.5 | 0.0032 | 2026-08-26 | Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. | |
CVE-2026-91448 |
high | 7.5 | 0.0040 | 2026-10-20 | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastru | |
CVE-2026-91465 |
high | 7.5 | 0.0030 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft | |
CVE-2026-91542 |
high | 7.5 | 0.0041 | 2026-10-20 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-91552 |
high | 7.5 | 0.0041 | 2026-10-20 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-91608 |
high | 7.5 | 0.0042 | 2026-10-20 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Suppo |