Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-47718 |
medium | 5.5 | 0.0046 | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, | |
CVE-2026-114260 |
medium | 5.5 | 0.0055 | 2026-10-21 | A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f | |
CVE-2026-116006 |
medium | 5.5 | 0.0083 | 2026-10-25 | A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected eleme | |
CVE-2026-116110 |
medium | 5.5 | 0.0041 | 2026-10-26 | A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some u | |
CVE-2026-4829 |
medium | 5.4 | 0.0017 | 2026-04-01 | Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 an | |
CVE-2024-58363 |
medium | 5.3 | 0.0034 | 2026-07-18 | SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches database | |
CVE-2026-87291 |
medium | 5.3 | 0.0031 | 2026-10-20 | Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are O | |
CVE-2026-103312 |
medium | 5.3 | 0.0024 | 2026-10-27 | The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of inc | |
CVE-2026-103332 |
medium | 5.3 | 0.0018 | 2026-10-27 | The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify t | |
CVE-2026-103331 |
medium | 5.3 | 0.0023 | 2026-10-28 | The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the | |
CVE-2026-6729 |
medium | 5.3 | 0.0020 | 2026-04-20 | HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that | |
CVE-2026-49872 |
medium | 5.3 | 0.0053 | 2026-06-19 | Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route | |
CVE-2026-58029 |
medium | 5.3 | 0.0035 | 2026-07-01 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil | |
CVE-2026-46715 |
medium | 5.3 | 0.0035 | 2026-07-20 | Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0' | |
CVE-2026-49447 |
medium | 5.3 | 0.0038 | 2026-07-28 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your appl | |
CVE-2026-73085 |
medium | 5.3 | 0.0046 | 2026-08-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck func | |
CVE-2026-68760 |
medium | 5.3 | 0.0046 | 2026-08-12 | An unauthenticated user may bypass authentication under specific cache conditions. | |
CVE-2026-19709 |
medium | 5.3 | 0.0032 | 2026-08-19 | The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer sec | |
CVE-2026-95718 |
medium | 5.3 | 0.0038 | 2026-10-22 | An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated | |
CVE-2026-110285 |
medium | 5.3 | 0.0020 | 2026-10-25 | The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature | |
CVE-2026-103306 |
medium | 5.3 | 0.0018 | 2026-10-26 | The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the a | |
CVE-2026-103319 |
medium | 5.3 | 0.0018 | 2026-10-26 | The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify tha | |
CVE-2026-116371 |
medium | 5.3 | 0.0040 | 2026-10-26 | A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. The impacted element is | |
CVE-2026-34389 |
medium | 4.9 | 0.0019 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the us | |
CVE-2026-109236 |
medium | 4.8 | 0.0034 | 2026-10-28 | The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication | |
CVE-2026-50623 |
medium | 4.8 | 0.0037 | 2026-06-12 | An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. | |
CVE-2026-116228 |
medium | 4.8 | 0.0014 | 2026-10-26 | A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function | |
CVE-2026-43766 |
medium | 4.6 | 0.0020 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Se | |
CVE-2026-56850 |
medium | 4.4 | 0.0008 | 2026-07-30 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing m | |
CVE-2026-34917 |
medium | 4.3 | 0.0038 | 2026-06-23 | Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, w | |
CVE-2026-60434 |
medium | 4.3 | 0.0027 | 2026-07-21 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Aut | |
CVE-2026-90862 |
medium | 4.3 | — | 2026-10-29 | Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior | |
CVE-2026-114438 |
medium | 4.2 | 0.0016 | 2026-10-21 | A flaw was found in the Update User Locale required action of the Keycloak identity and access manag | |
CVE-2026-87255 |
low | 3.7 | 0.0031 | 2026-10-20 | Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Ora | |
CVE-2026-87292 |
low | 3.7 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-60357 |
low | 3.7 | 0.0025 | 2026-07-21 | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Siebel Server S | |
CVE-2026-40109 |
low | 3.1 | 0.0013 | 2026-04-09 | Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolk | |
CVE-2026-7112 |
low | 2.9 | 0.0036 | 2026-04-27 | A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is | |
CVE-2026-7113 |
low | 2.9 | 0.0036 | 2026-04-27 | A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown | |
CVE-2026-14627 |
low | 2.9 | 0.0055 | 2026-07-04 | A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects t | |
CVE-2026-16198 |
low | 2.9 | 0.0063 | 2026-07-19 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown func | |
CVE-2026-75774 |
low | 2.9 | 0.0058 | 2026-08-18 | A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unk | |
CVE-2026-64745 |
low | 2.4 | 0.0017 | 2026-07-27 | This issue was addressed with additional restrictions on the lock screen. This issue is fixed in mac | |
CVE-2026-118129 |
low | 2.1 | 0.0034 | 2026-10-28 | A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. | |
CVE-2026-16015 |
low | 2.1 | 0.0058 | 2026-07-17 | A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the func | |
CVE-2026-16076 |
low | 2.1 | 0.0051 | 2026-07-18 | A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. This issue affects the function | |
CVE-2026-44961 |
none | — | 0.0041 | 2026-06-23 | The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As | |
CVE-2020-12812 |
— | — | 0.4538 | — | Fortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to | KEV |
CVE-2021-22893 |
— | — | 0.4717 | — | Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthentic | KEV |
CVE-2022-40684 |
— | — | 0.9998 | — | Fortinet FortiOS, FortiProxy, and FortiSwitchManager contain an authentication bypass vulnerability | KEV |