Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-81212 |
critical | 10.0 | 0.0027 | 2026-10-20 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary w | |
CVE-2026-70200 |
critical | 10.0 | 0.0060 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a | |
CVE-2026-34048 |
critical | 9.9 | 0.0080 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-42922 |
critical | 9.8 | — | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2 | |
CVE-2026-30496 |
critical | 9.8 | 0.0033 | 2026-05-07 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API o | |
CVE-2026-7663 |
critical | 9.8 | 0.0052 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p | |
CVE-2026-10543 |
critical | 9.8 | 0.0039 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with | |
CVE-2026-73644 |
critical | 9.6 | 0.0041 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identi | |
CVE-2026-59118 |
critical | 9.3 | 0.0072 | 2026-08-06 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over | |
CVE-2026-62835 |
critical | 9.3 | 0.0097 | 2026-07-24 | Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over | |
CVE-2026-116199 |
critical | 9.2 | 0.0032 | 2026-10-25 | Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallbac | |
CVE-2026-56160 |
critical | 9.1 | 0.0079 | 2026-07-23 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate pri | |
CVE-2026-43515 |
critical | 9.1 | 0.0122 | 2026-05-12 | Improper Authorization vulnerability when multiple method constraints define an HTTP method for the | |
CVE-2026-28312 |
critical | 9.1 | 0.0058 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s | |
CVE-2026-103506 |
high | 8.9 | — | 2026-10-28 | An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings w | |
CVE-2026-58424 |
high | 8.9 | 0.0025 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass | |
CVE-2026-56828 |
high | 8.8 | — | 2026-10-28 | Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin c | |
CVE-2026-54121 |
high | 8.8 | 0.0078 | 2026-07-14 | Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacke | 15 PoC |
CVE-2026-58277 |
high | 8.8 | 0.0094 | 2026-07-14 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privi | |
CVE-2026-35610 |
high | 8.8 | 0.0030 | 2026-04-07 | PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPass | |
CVE-2026-57983 |
high | 8.7 | 0.0065 | 2026-07-03 | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass | |
CVE-2026-43912 |
high | 8.7 | 0.0029 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not | |
CVE-2026-47663 |
high | 8.7 | 0.0041 | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health da | |
CVE-2026-5781 |
high | 8.5 | 0.0023 | 2026-04-28 | An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/updat | |
CVE-2025-40830 |
high | 8.4 | 0.0016 | 2025-12-09 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.10.0). The affected | |
CVE-2026-58284 |
high | 8.3 | 0.0056 | 2026-07-03 | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute | |
CVE-2026-64642 |
high | 8.3 | 0.0063 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16 | |
CVE-2026-42609 |
high | 8.1 | 0.0046 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav | |
CVE-2026-49877 |
high | 8.1 | 0.0051 | 2026-06-30 | Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console | |
CVE-2026-32821 |
high | 8.1 | 0.0035 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-60844 |
high | 8.1 | 0.0036 | 2026-07-21 | Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update S | |
CVE-2026-18499 |
high | 8.1 | 0.0042 | 2026-08-12 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege es | |
CVE-2026-57121 |
high | 8.1 | 0.0033 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-pla | |
CVE-2026-27912 |
high | 8.0 | 0.0041 | 2026-04-14 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over | |
CVE-2026-70218 |
high | 7.8 | 0.0036 | 2026-10-13 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attac | |
CVE-2026-49170 |
high | 7.8 | 0.0030 | 2026-07-14 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attac | |
CVE-2026-50344 |
high | 7.8 | 0.0030 | 2026-07-14 | Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally. | |
CVE-2026-50346 |
high | 7.8 | 0.0030 | 2026-07-14 | Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally. | |
CVE-2026-58540 |
high | 7.8 | 0.0030 | 2026-07-14 | Improper authorization in Windows Installer allows an authorized attacker to elevate privileges loca | |
CVE-2026-58631 |
high | 7.8 | 0.0030 | 2026-07-14 | Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally | |
CVE-2026-16925 |
high | 7.8 | 0.0013 | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege esca | |
CVE-2026-50279 |
high | 7.6 | 0.0036 | 2026-07-02 | Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, the | |
CVE-2026-60886 |
high | 7.6 | 0.0015 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal | |
CVE-2026-21584 |
high | 7.6 | 0.0042 | 2026-08-18 | This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 1 | |
CVE-2026-34320 |
high | 7.5 | 0.0031 | 2026-04-21 | Vulnerability in the Oracle Financial Services Customer Screening product of Oracle Financial Servic | |
CVE-2026-32807 |
high | 7.5 | 0.0039 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-32806 |
high | 7.5 | 0.0039 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-34239 |
high | 7.5 | 0.0046 | 2026-07-20 | Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the mai | |
CVE-2026-56241 |
high | 7.2 | 0.0026 | 2026-07-12 | Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users | |
CVE-2026-56313 |
high | 7.2 | 0.0050 | 2026-07-12 | Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prel |