Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-115333 |
high | 8.2 | 0.0036 | 2026-10-22 | Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion mid | |
CVE-2026-56836 |
high | 8.2 | 0.0023 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's | |
CVE-2026-106457 |
high | 8.1 | 0.0028 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.1.0 until 0.5.0, the @backstag | |
CVE-2026-83409 |
high | 8.1 | 0.0035 | 2026-10-20 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-112427 |
high | 8.1 | 0.0069 | 2026-10-26 | An authentication issue was addressed with improved state management. This issue is fixed in macOS G | |
CVE-2026-96228 |
high | 8.1 | 0.0047 | 2026-10-29 | SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypass in all versions u | |
CVE-2026-56169 |
high | 8.1 | 0.0075 | 2026-07-14 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges | |
CVE-2026-23708 |
high | 8.1 | 0.0028 | 2026-04-14 | A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR Pa | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side auth | |
CVE-2026-32804 |
high | 8.1 | 0.0023 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerabi | |
CVE-2026-49502 |
high | 8.1 | 0.0021 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Authentication vulnerabi | |
CVE-2026-55377 |
high | 8.1 | 0.0040 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's | |
CVE-2026-60416 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-60558 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente | |
CVE-2026-60599 |
high | 8.1 | 0.0036 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (componen | |
CVE-2026-61074 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (c | |
CVE-2026-61137 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Applicat | |
CVE-2026-61163 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O | |
CVE-2026-61225 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communicat | |
CVE-2026-62547 |
high | 8.1 | 0.0039 | 2026-07-21 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notific | |
CVE-2026-64665 |
high | 8.1 | 0.0054 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, w | |
CVE-2026-106488 |
high | 8.1 | 0.0028 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.4.20, the @backstage/plugi | |
CVE-2026-115546 |
high | 8.1 | 0.0042 | 2026-10-23 | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An au | |
CVE-2026-50365 |
high | 8.0 | 0.0054 | 2026-07-14 | Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges ove | |
CVE-2026-60579 |
high | 8.0 | 0.0029 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite ( | |
CVE-2026-61067 |
high | 8.0 | 0.0036 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-14541 |
high | 8.0 | 0.0025 | 2026-07-31 | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider co | |
CVE-2026-44711 |
high | 7.9 | 0.0024 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, s | |
CVE-2026-92376 |
high | 7.8 | 0.0013 | 2026-10-27 | Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Mana | |
CVE-2026-57107 |
high | 7.8 | 0.0030 | 2026-07-14 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges | |
CVE-2026-41276 |
high | 7.7 | 0.0687 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-58423 |
high | 7.7 | 0.0039 | 2026-07-03 | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repo | |
CVE-2026-100709 |
high | 7.7 | 0.0029 | 2026-09-26 | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) wit | |
CVE-2025-60424 |
high | 7.6 | 0.0072 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 all | |
CVE-2024-7956 |
high | 7.6 | 0.0035 | 2026-09-02 | A vulnerability exists in the affected products that allows a threat actor to gain access to user’s | |
CVE-2026-59208 |
high | 7.6 | 0.0027 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, | |
CVE-2026-60578 |
high | 7.6 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite ( | |
CVE-2026-53958 |
high | 7.6 | 0.0040 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an au | |
CVE-2026-91493 |
high | 7.5 | 0.0031 | 2026-10-20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-93757 |
high | 7.5 | 0.0043 | 2026-10-29 | The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Col | |
CVE-2023-25957 |
high | 7.5 | 0.0058 | 2023-03-14 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < | |
CVE-2026-5959 |
high | 7.5 | 0.0051 | 2026-04-09 | A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1. Affect | |
CVE-2026-42855 |
high | 7.5 | 0.0035 | 2026-05-12 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 | |
CVE-2026-48929 |
high | 7.5 | 0.0072 | 2026-06-17 | Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vul | |
CVE-2026-41896 |
high | 7.5 | 0.0028 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-55727 |
high | 7.5 | 0.0050 | 2026-07-06 | A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 | |
CVE-2026-59954 |
high | 7.5 | 0.0057 | 2026-07-15 | Apollo is a reliable configuration management system suitable for microservice configuration managem | |
CVE-2026-59955 |
high | 7.5 | 0.0057 | 2026-07-15 | Apollo is a reliable configuration management system suitable for microservice configuration managem | |
CVE-2026-48812 |
high | 7.5 | 0.0047 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-60598 |
high | 7.5 | 0.0033 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (componen |