Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1099)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-91360 |
medium | 6.5 | 0.0027 | 2026-10-20 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C | |
CVE-2026-116691 |
medium | 6.5 | 0.0021 | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-110292 |
medium | 6.5 | 0.0022 | 2026-10-28 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the reques | |
CVE-2026-105617 |
medium | 6.5 | 0.0022 | 2026-10-28 | PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Us | |
CVE-2026-49159 |
medium | 6.5 | 0.0100 | 2026-07-24 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized a | |
CVE-2026-61918 |
medium | 6.5 | 0.0092 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information | |
CVE-2026-61921 |
medium | 6.5 | 0.0092 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information | |
CVE-2026-47282 |
medium | 6.5 | 0.0087 | 2026-07-14 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized | |
CVE-2026-56646 |
medium | 6.5 | 0.0092 | 2026-07-03 | Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows | |
CVE-2026-61924 |
medium | 6.5 | 0.0092 | 2026-08-11 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information | |
CVE-2026-65769 |
medium | 6.5 | 0.0092 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unaut | |
CVE-2026-66301 |
medium | 6.5 | 0.0100 | 2026-08-11 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) a | |
CVE-2026-33882 |
medium | 6.5 | 0.0027 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and | |
CVE-2026-33886 |
medium | 6.5 | 0.0023 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 an | |
CVE-2026-5291 |
medium | 6.5 | 0.0025 | 2026-04-01 | Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote atta | |
CVE-2026-32151 |
medium | 6.5 | 0.0075 | 2026-04-14 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized att | |
CVE-2026-25219 |
medium | 6.5 | 0.0055 | 2026-04-15 | The `access_key` and `connection_string` connection properties were not marked as sensitive names in | |
CVE-2026-23777 |
medium | 6.5 | 0.0030 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions | |
CVE-2026-6770 |
medium | 6.5 | 0.0388 | 2026-04-21 | Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefo | |
CVE-2026-34300 |
medium | 6.5 | 0.0029 | 2026-04-21 | Vulnerability in the PeopleSoft Enterprise FIN Contracts product of Oracle PeopleSoft (component: Co | |
CVE-2026-34313 |
medium | 6.5 | 0.0029 | 2026-04-21 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Ora | |
CVE-2026-7382 |
medium | 6.5 | 0.0034 | 2026-04-30 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information | |
CVE-2026-42092 |
medium | 6.5 | 0.0022 | 2026-05-04 | titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publica | |
CVE-2026-42220 |
medium | 6.5 | 0.0030 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated | |
CVE-2026-42223 |
medium | 6.5 | 0.0029 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings A | |
CVE-2026-28920 |
medium | 6.5 | 0.0032 | 2026-05-11 | An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 a | |
CVE-2026-28922 |
medium | 6.5 | 0.0032 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. | |
CVE-2026-40374 |
medium | 6.5 | 0.0087 | 2026-05-12 | Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized at | |
CVE-2026-8405 |
medium | 6.5 | 0.0023 | 2026-05-27 | IBM Guardium Data Protection 12.2.1, and 12.2.2 's add-on feature of Guardium Data Protection named | |
CVE-2026-47124 |
medium | 6.5 | 0.0034 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-47340 |
medium | 6.5 | 0.0043 | 2026-06-17 | Allow authenticated users to access alert instances associated with alert groups they do not have pe | |
CVE-2026-9153 |
medium | 6.5 | 0.0045 | 2026-06-25 | Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated | |
CVE-2026-44736 |
medium | 6.5 | 0.0036 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/ | |
CVE-2026-13810 |
medium | 6.5 | 0.0032 | 2026-06-30 | Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a rem | |
CVE-2026-14004 |
medium | 6.5 | 0.0032 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14096 |
medium | 6.5 | 0.0029 | 2026-06-30 | Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a r | |
CVE-2026-14098 |
medium | 6.5 | 0.0029 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14146 |
medium | 6.5 | 0.0032 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14898 |
medium | 6.5 | 0.0037 | 2026-07-06 | The OpenAI Codex desktop app for macOS rendered remote images from Markdown in model responses. An a | |
CVE-2026-48828 |
medium | 6.5 | 0.0066 | 2026-07-07 | The Bulk Variables API in Apache Airflow called the redactor without passing the variable's key, so | |
CVE-2026-48892 |
medium | 6.5 | 0.0066 | 2026-07-07 | The Config API in Apache Airflow surfaced per-key secrets-backend overrides (environment variables l | |
CVE-2026-49487 |
medium | 6.5 | 0.0066 | 2026-07-07 | In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a defe | |
CVE-2026-44877 |
medium | 6.5 | 0.0046 | 2026-07-07 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On | |
CVE-2026-45737 |
medium | 6.5 | 0.0052 | 2026-07-15 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3 | |
CVE-2026-35143 |
medium | 6.5 | 0.0016 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to | |
CVE-2026-47009 |
medium | 6.5 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & At | |
CVE-2026-60350 |
medium | 6.5 | 0.0017 | 2026-07-21 | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). | |
CVE-2026-60557 |
medium | 6.5 | 0.0037 | 2026-07-21 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-60609 |
medium | 6.5 | 0.0039 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (compone | |
CVE-2026-60673 |
medium | 6.5 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Sup |