Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2023-29131 |
critical | 10.0 | 0.0042 | 2023-07-11 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consis | |
CVE-2026-12602 |
high | 8.8 | 0.0018 | 2026-06-22 | Incorrect default permissions in ArubaSign, affecting versions prior to v4.6.6. The vulnerability is | |
CVE-2023-54366 |
high | 8.7 | 0.0046 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREA | |
CVE-2026-6819 |
high | 8.7 | 0.0029 | 2026-04-21 | HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin i | |
CVE-2026-112357 |
high | 8.5 | 0.0013 | 2026-10-28 | GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 | |
CVE-2026-39454 |
high | 8.5 | 0.0011 | 2026-04-20 | SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder | |
CVE-2026-0539 |
high | 8.5 | 0.0010 | 2026-04-22 | Incorrect Default Permissions in pcvisit service binary on Windows allows a low-privileged local att | |
CVE-2026-45393 |
high | 8.5 | 0.0022 | 2026-05-12 | A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to e | |
CVE-2026-0432 |
high | 8.5 | 0.0010 | 2026-05-15 | Incorrect default permissions in the installation directory for the AMD chipset driver could allow a | |
CVE-2026-33590 |
high | 8.5 | 0.0045 | 2026-05-28 | Insecure default settings of Portainer CE grant regular (non-admin) users privileges that allow host | |
CVE-2026-57895 |
high | 8.5 | 0.0016 | 2026-07-08 | Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place | |
CVE-2026-61828 |
high | 8.5 | 0.0015 | 2026-07-15 | Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Pri | |
CVE-2026-40952 |
high | 8.5 | 0.0014 | 2026-07-15 | CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client | |
CVE-2026-63425 |
high | 8.5 | 0.0015 | 2026-08-13 | During an internal security assessment, a potential improper permissions vulnerability was discovere | |
CVE-2026-6823 |
high | 8.3 | 0.0034 | 2026-04-21 | HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerabil | |
CVE-2026-17497 |
high | 8.3 | 0.0075 | 2026-07-26 | NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, | |
CVE-2026-53657 |
high | 8.2 | 0.0020 | 2026-07-10 | Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on | |
CVE-2026-48725 |
high | 8.1 | 0.0038 | 2026-06-24 | Warp is an agentic development environment. From 0.2021.04.25.23.05.stable_00 until 0.2026.05.06.15. | |
CVE-2026-21765 |
high | 7.8 | 0.0010 | 2026-04-02 | HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private | |
CVE-2026-25203 |
high | 7.8 | 0.0018 | 2026-04-10 | Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability | |
CVE-2026-39874 |
high | 7.8 | 0.0015 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia | |
CVE-2026-39875 |
high | 7.8 | 0.0015 | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia | |
CVE-2026-113345 |
high | 7.8 | 0.0012 | 2026-10-26 | Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastruct | |
CVE-2026-114148 |
high | 7.8 | — | 2026-10-29 | Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges lo | 1 PoC |
CVE-2025-61035 |
high | 7.7 | 0.0015 | 2025-10-22 | The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given | |
CVE-2026-105009 |
high | 7.5 | 0.0032 | 2026-10-13 | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elev | |
CVE-2026-41712 |
high | 7.5 | 0.0026 | 2026-05-12 | Spring AI's chat memory component contained a problematic default that, when not explicitly overridd | |
CVE-2026-107052 |
high | 7.5 | — | 2026-10-29 | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows | |
CVE-2026-59119 |
high | 7.3 | 0.0038 | 2026-08-11 | Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privi | |
CVE-2026-16246 |
high | 7.3 | 0.0015 | 2026-07-20 | In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a r | |
CVE-2026-16247 |
high | 7.3 | 0.0014 | 2026-07-20 | In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup | |
CVE-2026-4793 |
high | 7.3 | 0.0015 | 2026-08-03 | An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local | |
CVE-2026-115253 |
high | 7.3 | 0.0013 | 2026-10-22 | An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a lo | |
CVE-2026-21074 |
high | 7.2 | 0.0014 | 2026-08-10 | Incorrect default permissions in Bixby prior to version 4.0.86.0 allows local attackers to execute a | |
CVE-2026-32983 |
medium | 6.9 | 0.0044 | 2026-03-27 | Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper res | |
CVE-2026-21013 |
medium | 6.9 | 0.0009 | 2026-04-13 | Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to | |
CVE-2026-21015 |
medium | 6.8 | 0.0009 | 2026-05-13 | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker | |
CVE-2026-11931 |
medium | 6.8 | 0.0012 | 2026-06-15 | Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose th | |
CVE-2026-53870 |
medium | 6.8 | 0.0016 | 2026-06-17 | Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-reada | |
CVE-2026-65940 |
medium | 6.8 | 0.0035 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files t | |
CVE-2025-46185 |
medium | 6.2 | 0.0014 | 2025-10-24 | An Insecure Permission vulnerability in pgcodekeeper 10.12.0 allows a local attacker to obtain sensi | |
CVE-2026-48790 |
medium | 5.5 | 0.0015 | 2026-08-11 | Turso CLI is the command line interface (CLI) to the open-source database Turso. Versions prior to 1 | |
CVE-2026-50255 |
medium | 5.4 | 0.0009 | 2026-06-16 | Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and ea | |
CVE-2026-57924 |
medium | 5.3 | 0.0027 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile | |
CVE-2026-27680 |
medium | 4.3 | 0.0017 | 2026-05-14 | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allow | |
CVE-2026-48935 |
low | 3.3 | 0.0019 | 2026-06-26 | A flaw in Node.js Permission API can cause a file metadata to be modified even on a path that was se | |
CVE-2024-58356 |
low | 2.3 | 0.0027 | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERW | |
CVE-2026-12823 |
low | 1.9 | 0.0016 | 2026-06-22 | A security flaw has been discovered in Browserbase Skills up to 20260526. This impacts an unknown fu | |
CVE-2026-87886 |
— | — | 0.0023 | — | Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permiss | KEV |
CVE-2013-0632 |
— | — | 0.9308 | — | An authentication bypass vulnerability exists in Adobe ColdFusion which could result in an unauthori | KEV |