Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-53576 |
critical | 10.0 | 0.0330 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authe | |
CVE-2026-33591 |
critical | 10.0 | 0.0071 | 2026-08-03 | A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker | |
CVE-2026-79844 |
critical | 10.0 | 0.0069 | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthentic | |
CVE-2026-79850 |
critical | 10.0 | 0.0069 | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to | |
CVE-2026-107656 |
critical | 9.8 | 0.0085 | 2026-10-26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5 | |
CVE-2025-49901 |
critical | 9.8 | 0.0073 | 2025-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in quantumcloud Simple Link D | |
CVE-2026-6760 |
critical | 9.8 | 0.0028 | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 | |
CVE-2026-6768 |
critical | 9.8 | 0.0029 | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 | |
CVE-2026-6771 |
critical | 9.8 | 0.0031 | 2026-04-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firef | |
CVE-2026-49764 |
critical | 9.8 | 0.0040 | 2026-06-15 | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions. | |
CVE-2026-49767 |
critical | 9.8 | 0.0055 | 2026-06-17 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-57807 |
critical | 9.8 | 0.0073 | 2026-07-10 | Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Softwa | |
CVE-2026-24254 |
critical | 9.8 | 0.0089 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attack | |
CVE-2026-66465 |
critical | 9.8 | 0.0061 | 2026-08-13 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | |
CVE-2026-74001 |
critical | 9.8 | 0.0061 | 2026-08-20 | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. | |
CVE-2026-79855 |
critical | 9.8 | 0.0075 | 2026-10-22 | An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote a | |
CVE-2026-58073 |
critical | 9.5 | 0.0032 | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonat | |
CVE-2026-63190 |
critical | 9.4 | — | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior | |
CVE-2026-61425 |
critical | 9.4 | 0.0057 | 2026-07-20 | Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gri | |
CVE-2026-40630 |
critical | 9.3 | 0.0073 | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows unauthorized access to certa | |
CVE-2026-42300 |
critical | 9.3 | 0.0026 | 2026-05-12 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1.2.2, the S | |
CVE-2026-40621 |
critical | 9.3 | 0.0049 | 2026-05-13 | ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. | |
CVE-2026-4320 |
critical | 9.3 | 0.0025 | 2026-05-18 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to gain unaut | |
CVE-2026-35087 |
critical | 9.3 | 0.0066 | 2026-05-27 | Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypa | |
CVE-2026-35090 |
critical | 9.3 | 0.0063 | 2026-05-27 | In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticate | |
CVE-2026-55666 |
critical | 9.3 | 0.0041 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8 | |
CVE-2026-58172 |
critical | 9.3 | 0.0056 | 2026-06-30 | Ocelot through 24.1.0, fixed in commit f156fd4, contains a security control bypass vulnerability tha | |
CVE-2026-75627 |
critical | 9.3 | 0.0084 | 2026-08-18 | Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unaut | |
CVE-2026-19490 |
critical | 9.3 | 0.3265 | 2026-08-19 | Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving | KEV |
CVE-2026-93866 |
critical | 9.2 | 0.0045 | 2026-10-27 | An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware O | |
CVE-2026-8338 |
critical | 9.2 | 0.0050 | 2026-07-29 | A Spring Security authentication and authorization bypass exists in Coverity Connect versions betwee | |
CVE-2026-68584 |
critical | 9.2 | 0.0053 | 2026-08-03 | SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where c | |
CVE-2026-40582 |
critical | 9.1 | 0.0050 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/us | |
CVE-2026-73381 |
critical | 9.1 | 0.0055 | 2026-08-18 | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | |
CVE-2026-71879 |
critical | 9.1 | 0.0086 | 2026-08-18 | Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integr | |
CVE-2026-62916 |
critical | 9.1 | 0.0086 | 2026-09-03 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorize | |
CVE-2026-43945 |
high | 8.9 | 0.0084 | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3. | |
CVE-2026-49062 |
high | 8.8 | 0.0030 | 2026-06-15 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows | |
CVE-2026-42629 |
high | 8.8 | 0.0032 | 2026-06-17 | Unauthenticated Broken Authentication in PowerPack Pro for Elementor < v2.13.0 versions. | |
CVE-2026-65542 |
high | 8.8 | 0.0050 | 2026-08-06 | Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | |
CVE-2026-50191 |
high | 8.8 | 0.0047 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerabl | |
CVE-2026-32678 |
high | 8.7 | 0.0037 | 2026-03-27 | Authentication bypass issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to | |
CVE-2026-8697 |
high | 8.7 | 0.0051 | 2026-05-28 | Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, | |
CVE-2026-22049 |
high | 8.7 | 0.0053 | 2026-07-22 | ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susc | |
CVE-2026-56243 |
high | 8.6 | 0.0035 | 2026-06-23 | Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane | |
CVE-2026-107671 |
high | 8.5 | 0.0035 | 2026-10-27 | A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor aut | |
CVE-2026-3324 |
high | 8.2 | 0.0126 | 2026-04-16 | Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on | |
CVE-2026-42735 |
high | 8.2 | 0.0026 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kiv | |
CVE-2026-18556 |
high | 8.2 | 0.0788 | 2026-08-01 | N-able N-central contains an authentication bypass using an alternate path or channel that allows fo | KEV |
CVE-2026-18577 |
high | 8.2 | 0.1462 | 2026-08-02 | N-able N-central contains an authentication bypass using an alternate path or channel allows for aut | KEV |