Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-9192 |
critical | 9.8 | 0.0083 | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server before 11 | |
CVE-2026-48087 |
critical | 9.8 | 0.0057 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-65400 |
critical | 9.8 | 0.0172 | 2026-08-06 | Apple macOS contains an improper authentication vulnerability that could allow an attacker on the ne | KEV |
CVE-2026-40920 |
critical | 9.8 | 0.0073 | 2026-08-10 | Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are re | |
CVE-2026-12571 |
critical | 9.8 | 0.0327 | 2026-08-11 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeov | |
CVE-2026-26035 |
critical | 9.8 | 0.0075 | 2026-08-12 | An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through | |
CVE-2026-70905 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent inf | |
CVE-2026-101484 |
critical | 9.8 | 0.0054 | 2026-10-20 | Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are | |
CVE-2026-101521 |
critical | 9.8 | 0.0058 | 2026-10-20 | Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0- | |
CVE-2026-91665 |
critical | 9.8 | 0.0047 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-76474 |
critical | 9.8 | 0.0047 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams f | |
CVE-2026-110956 |
critical | 9.8 | 0.0036 | 2026-10-24 | The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine secon | |
CVE-2026-93680 |
critical | 9.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions | 1 PoC |
CVE-2026-62896 |
critical | 9.6 | 0.0069 | 2026-08-06 | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over | |
CVE-2026-44547 |
critical | 9.6 | 0.0026 | 2026-05-12 | ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 | |
CVE-2026-59151 |
critical | 9.6 | 0.0053 | 2026-07-10 | Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted th | |
CVE-2026-22752 |
critical | 9.6 | 0.0048 | 2026-07-16 | Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Serv | |
CVE-2026-35030 |
critical | 9.4 | 0.0063 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83. | |
CVE-2026-41571 |
critical | 9.4 | 0.0037 | 2026-05-04 | Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in backend/d | |
CVE-2026-52830 |
critical | 9.4 | 0.0065 | 2026-07-02 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer | |
CVE-2026-53595 |
critical | 9.4 | 0.0194 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-50561 |
critical | 9.4 | 0.0068 | 2026-08-12 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor | |
CVE-2026-117532 |
critical | 9.3 | 0.0068 | 2026-10-27 | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structur | |
CVE-2026-39324 |
critical | 9.3 | 0.0027 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Ses | |
CVE-2026-8979 |
critical | 9.3 | 0.0078 | 2026-05-28 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. A | |
CVE-2026-11717 |
critical | 9.3 | 0.0018 | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateO | |
CVE-2026-11718 |
critical | 9.3 | 0.0019 | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path (validateO | |
CVE-2026-56223 |
critical | 9.3 | 0.0040 | 2026-06-24 | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-us | |
CVE-2026-55666 |
critical | 9.3 | 0.0041 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8 | |
CVE-2026-61740 |
critical | 9.3 | 0.0051 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, when LightRAG is d | |
CVE-2026-55445 |
critical | 9.3 | 0.0053 | 2026-07-15 | Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. | |
CVE-2026-16232 |
critical | 9.3 | 0.0352 | 2026-07-22 | Check Point SmartConsole contains an improper authentication vulnerability which could allow an unau | KEV |
CVE-2026-100886 |
critical | 9.3 | 0.0115 | 2026-09-27 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. | |
CVE-2026-114509 |
critical | 9.2 | 0.0078 | 2026-10-21 | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a sta | |
CVE-2026-87302 |
critical | 9.1 | 0.0042 | 2026-10-20 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-91490 |
critical | 9.1 | 0.0040 | 2026-10-20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-29145 |
critical | 9.1 | 0.0072 | 2026-04-09 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled v | |
CVE-2026-34727 |
critical | 9.1 | 0.0028 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback ha | |
CVE-2026-40910 |
critical | 9.1 | 0.0027 | 2026-04-21 | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTT | |
CVE-2026-33117 |
critical | 9.1 | 0.0048 | 2026-05-12 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptograph | |
CVE-2026-44196 |
critical | 9.1 | 0.0030 | 2026-05-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.16.2, a cri | |
CVE-2026-44351 |
critical | 9.1 | 0.0025 | 2026-05-13 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical authenticatio | |
CVE-2026-49454 |
critical | 9.1 | 0.0023 | 2026-06-18 | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0 | |
CVE-2026-10560 |
critical | 9.1 | 0.0048 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil | |
CVE-2026-15089 |
critical | 9.1 | 0.0040 | 2026-07-10 | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest registration | |
CVE-2026-45363 |
critical | 9.1 | 0.0036 | 2026-07-14 | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and | |
CVE-2026-60326 |
critical | 9.1 | 0.0043 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-71277 |
critical | 9.1 | 0.0042 | 2026-08-05 | rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the | |
CVE-2026-48039 |
critical | 9.1 | 0.0059 | 2026-08-07 | Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to | |
CVE-2026-73501 |
critical | 9.1 | 0.0043 | 2026-08-12 | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() i |