Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (542)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-5483 |
critical | 9.9 | 0.0049 | 2026-04-10 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` | |
CVE-2026-39912 |
critical | 9.1 | 0.0060 | 2026-04-09 | V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response b | |
CVE-2026-13380 |
critical | 9.0 | 0.0039 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP response | |
CVE-2026-4525 |
high | 8.8 | 0.0041 | 2026-04-17 | If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorizati | |
CVE-2026-53920 |
high | 8.7 | 0.0040 | 2026-10-23 | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 | |
CVE-2026-67425 |
high | 8.6 | 0.0041 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat | |
CVE-2023-3399 |
high | 8.5 | 0.0045 | 2023-11-06 | An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, a | |
CVE-2026-54848 |
high | 8.3 | 0.0032 | 2026-06-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for | |
CVE-2026-45049 |
high | 8.3 | — | 2026-10-29 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain | |
CVE-2026-86409 |
high | 8.1 | 0.0031 | 2026-10-20 | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectati | |
CVE-2026-42379 |
high | 7.7 | 0.0021 | 2026-04-27 | Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Ret | |
CVE-2026-115591 |
high | 7.5 | 0.0034 | 2026-10-28 | Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsyst | |
CVE-2025-64213 |
high | 7.5 | 0.0036 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pr | |
CVE-2026-49064 |
high | 7.5 | 0.0024 | 2026-06-15 | Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve E | |
CVE-2026-39480 |
high | 7.5 | 0.0038 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. | |
CVE-2026-40789 |
high | 7.5 | 0.0029 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions. | |
CVE-2026-42384 |
high | 7.5 | 0.0029 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions. | |
CVE-2026-52692 |
high | 7.5 | 0.0024 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. | |
CVE-2026-52695 |
high | 7.5 | 0.0024 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions. | |
CVE-2026-54841 |
high | 7.5 | 0.0042 | 2026-06-25 | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | |
CVE-2026-54834 |
high | 7.5 | 0.0042 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. | |
CVE-2026-7189 |
high | 7.5 | 0.0042 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's | |
CVE-2026-7488 |
high | 7.5 | 0.0042 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce a | |
CVE-2026-66901 |
high | 7.5 | 0.0052 | 2026-08-04 | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltra | |
CVE-2026-65543 |
high | 7.5 | 0.0042 | 2026-08-06 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | |
CVE-2026-47717 |
high | 7.5 | 0.0138 | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3 | |
CVE-2026-66463 |
high | 7.5 | 0.0042 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. | |
CVE-2026-66585 |
high | 7.5 | 0.0042 | 2026-08-24 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | |
CVE-2026-118083 |
high | 7.5 | — | 2026-10-29 | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | |
CVE-2026-49082 |
high | 7.4 | 0.0026 | 2026-06-15 | Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ &a | |
CVE-2026-52698 |
high | 7.4 | 0.0021 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & | |
CVE-2026-54821 |
high | 7.4 | 0.0028 | 2026-06-25 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. | |
CVE-2026-54660 |
high | 7.4 | 0.0031 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-20151 |
high | 7.3 | 0.0027 | 2026-04-01 | A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could all | |
CVE-2026-42746 |
high | 7.3 | 0.0019 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Cl | |
CVE-2026-27868 |
medium | 6.9 | 0.0039 | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case | |
CVE-2026-22551 |
medium | 6.7 | 0.0031 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI response | |
CVE-2026-105777 |
medium | 6.5 | 0.0028 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19. | |
CVE-2026-4927 |
medium | 6.5 | 0.0023 | 2026-04-01 | Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with u | |
CVE-2026-40161 |
medium | 6.5 | 0.0026 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting | |
CVE-2026-48877 |
medium | 6.5 | 0.0030 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retriev | |
CVE-2026-48965 |
medium | 6.5 | 0.0033 | 2026-06-15 | Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions. | |
CVE-2026-54197 |
medium | 6.5 | 0.0027 | 2026-06-16 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. | |
CVE-2026-57318 |
medium | 6.5 | 0.0037 | 2026-06-26 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. | |
CVE-2026-13437 |
medium | 6.5 | 0.0044 | 2026-06-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell | |
CVE-2026-12085 |
medium | 6.5 | 0.0038 | 2026-06-30 | IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0. | |
CVE-2026-57347 |
medium | 6.5 | 0.0037 | 2026-07-02 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. | |
CVE-2026-1365 |
medium | 6.5 | 0.0046 | 2026-07-09 | Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OS | |
CVE-2026-56460 |
medium | 6.5 | 0.0038 | 2026-07-09 | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated | |
CVE-2026-27372 |
medium | 6.5 | 0.0037 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. |