Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-18702 |
medium | 5.3 | 0.0027 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privilege | |
CVE-2026-75845 |
medium | 5.3 | 0.0029 | 2026-08-18 | ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_ser | |
CVE-2026-70974 |
medium | 5.3 | 0.0028 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-71108 |
medium | 5.3 | 0.0028 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-40001 |
medium | 5.2 | 0.0013 | 2026-05-06 | There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud co | |
CVE-2026-15379 |
medium | 5.1 | 0.0015 | 2026-07-17 | The Altiris WMI provider exposes a class (AltirisAgent_Stream) that allows any local standard user t | |
CVE-2026-15380 |
medium | 5.1 | 0.0017 | 2026-07-17 | A non-administrator interactive user can obtain full SYSTEM code execution through a DCOM/task sched | |
CVE-2026-19360 |
medium | 5.1 | 0.0038 | 2026-08-09 | A vulnerability was detected in wongcyrus ExcelLexBot up to 0.0.3. This affects the function ExcelLe | |
CVE-2026-7778 |
medium | 5.0 | 0.0017 | 2026-05-05 | An issue that could allow a dashboard configuration to be viewed from outside of the authorized orga | |
CVE-2026-39961 |
medium | 4.9 | 0.0040 | 2026-04-09 | Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster. From | |
CVE-2026-71085 |
medium | 4.9 | 0.0040 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-1726 |
medium | 4.8 | 0.0019 | 2026-04-23 | IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation | |
CVE-2026-12313 |
medium | 4.7 | 0.0018 | 2026-06-16 | Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerabi | |
CVE-2026-71105 |
medium | 4.7 | 0.0012 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-48926 |
medium | 4.3 | 0.0017 | 2026-05-27 | Jenkins Job Import Plugin 143.v044a_2e819b_27 and earlier does not perform a permission check in an | |
CVE-2026-20308 |
medium | 4.3 | 0.0044 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authen | |
CVE-2026-70443 |
medium | 4.3 | 0.0027 | 2026-08-05 | Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context f | |
CVE-2026-54319 |
medium | 4.2 | 0.0024 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-60938 |
medium | 4.1 | 0.0013 | 2026-07-21 | Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Intern | |
CVE-2026-70848 |
low | 3.7 | 0.0026 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-60847 |
low | 3.4 | 0.0015 | 2026-07-21 | Vulnerability in the Oracle Order Entry product of Oracle E-Business Suite (component: Internal Oper | |
CVE-2026-86933 |
low | 3.3 | 0.0013 | 2026-10-20 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS | |
CVE-2026-31369 |
low | 3.2 | 0.0010 | 2026-04-21 | PcManager is affected by type privilege bypass, successful exploitation of this vulnerability may af | |
CVE-2026-44218 |
low | 3.0 | 0.0012 | 2026-05-12 | ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io | |
CVE-2026-116471 |
low | 2.1 | 0.0020 | 2026-10-26 | A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown | |
CVE-2026-16764 |
low | 2.1 | 0.0041 | 2026-07-23 | A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSeria | |
CVE-2026-19005 |
low | 2.1 | 0.0037 | 2026-08-06 | A vulnerability was detected in nanocoai NanoClaw up to 2.0.64. Affected is the function handleCreat | |
CVE-2026-19007 |
low | 2.1 | 0.0037 | 2026-08-06 | A vulnerability was determined in mf-yang openclaw-cn up to 0.2.1. This vulnerability affects the fu | |
CVE-2026-116162 |
low | 2.1 | 0.0038 | 2026-10-25 | Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with mast | |
CVE-2026-0275 |
low | 2.0 | 0.0016 | 2026-07-09 | A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally au | |
CVE-2026-0276 |
low | 1.1 | 0.0014 | 2026-07-09 | A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally a | |
CVE-2019-1405 |
— | — | 0.3017 | — | A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM obje | KEV |
CVE-2021-20021 |
— | — | 0.8878 | — | SonicWall Email Security contains an improper privilege management vulnerability that allows an atta | KEV |
CVE-2024-38014 |
— | — | 0.0626 | — | Microsoft Windows Installer contains an improper privilege management vulnerability that could allow | KEV |
CVE-2026-6750 |
— | — | 0.0048 | 2026-04-21 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1 | |
CVE-2026-46817 |
— | — | 0.1231 | — | Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unaut | KEV |
CVE-2026-12289 |
— | — | 0.0040 | 2026-06-16 | Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1 | |
CVE-2026-74950 |
— | — | 0.0042 | 2026-08-18 | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Fi | |
CVE-2026-84869 |
— | — | 0.0092 | — | ConnectWise ScreenConnect contains both an improper privilege management and missing authorization v | KEV |
CVE-2026-64753 |
— | — | 0.0030 | 2026-09-14 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, | |
CVE-2026-65354 |
— | — | 0.0014 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP | |
CVE-2026-84587 |
— | — | 0.0015 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden | |
CVE-2026-84603 |
— | — | 0.0015 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP | |
CVE-2026-86884 |
— | — | 0.0014 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP | |
CVE-2026-86888 |
— | — | 0.0014 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP | |
CVE-2026-86893 |
— | — | 0.0014 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP | |
CVE-2026-102490 |
— | — | 0.1094 | — | Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local | KEV |
CVE-2026-28853 |
— | — | 0.0014 | 2026-10-20 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe | |
CVE-2026-86921 |
— | — | 0.0014 | 2026-10-20 | A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPad | |
CVE-2002-0367 |
— | — | 0.0492 | — | smss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that conne | KEV |