Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-25439 |
high | 8.1 | 0.0034 | 2026-06-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Booknetic Booknetic bookne | |
CVE-2025-13018 |
high | 8.1 | 0.0027 | 2025-11-11 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firef | |
CVE-2026-42411 |
high | 8.1 | 0.0040 | 2026-06-15 | Unauthenticated Broken Authentication in CloudSecure WP Security <= 1.4.7 versions. | |
CVE-2026-48970 |
high | 8.1 | 0.0039 | 2026-06-15 | Unauthenticated Broken Authentication in Really Simple SSL <= 9.5.10 versions. | |
CVE-2026-59545 |
high | 8.1 | 0.0046 | 2026-07-23 | Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. | |
CVE-2026-70468 |
high | 8.1 | 0.0046 | 2026-08-12 | A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7. | |
CVE-2026-29139 |
high | 7.8 | 0.0027 | 2026-04-02 | SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by abusing GINA account | |
CVE-2026-54804 |
high | 7.6 | 0.0027 | 2026-06-17 | Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions. | |
CVE-2026-42760 |
high | 7.5 | 0.0029 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in revmakx Backup and Staging | |
CVE-2026-42668 |
high | 7.5 | 0.0043 | 2026-06-15 | Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versi | |
CVE-2026-56029 |
high | 7.5 | 0.0043 | 2026-06-26 | Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions. | |
CVE-2026-57697 |
high | 7.5 | 0.0048 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid pro | |
CVE-2026-72691 |
high | 7.5 | 0.0065 | 2026-08-10 | An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unaut | |
CVE-2026-39769 |
high | 7.5 | 0.0049 | 2026-10-06 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Designs Graphina – | |
CVE-2026-12579 |
high | 7.4 | 0.0046 | 2026-07-01 | AS228T with Authentication Bypass Vulnerability | |
CVE-2026-42745 |
high | 7.3 | 0.0024 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ZAYTECH Smart Online Order | |
CVE-2026-42749 |
high | 7.1 | 0.0025 | 2026-05-27 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeisle Disable Comments | |
CVE-2026-39450 |
high | 7.1 | 0.0039 | 2026-06-15 | Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. | |
CVE-2026-40785 |
high | 7.1 | 0.0039 | 2026-06-15 | Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions. | |
CVE-2026-39385 |
high | 7.1 | 0.0037 | 2026-07-20 | Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could | |
CVE-2026-73396 |
high | 7.1 | 0.0040 | 2026-08-18 | Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions. | |
CVE-2026-24185 |
high | 7.1 | 0.0030 | 2026-08-18 | NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configura | |
CVE-2026-114635 |
high | 7.0 | 0.0019 | 2026-10-22 | Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check | |
CVE-2026-58517 |
medium | 6.9 | 0.0033 | 2026-07-01 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - W | |
CVE-2026-18636 |
medium | 6.8 | 0.0040 | 2026-08-11 | The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. | |
CVE-2026-114732 |
medium | 6.8 | 0.0036 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vul | |
CVE-2026-41308 |
medium | 6.5 | 0.0029 | 2026-05-08 | Password Pusher is an open source application to communicate sensitive information over the web. Pri | |
CVE-2026-40790 |
medium | 6.5 | 0.0033 | 2026-06-15 | Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions. | |
CVE-2026-42378 |
medium | 6.5 | 0.0039 | 2026-06-15 | Subscriber Broken Authentication in WP Full Stripe Free <= 8.4.1 versions. | |
CVE-2026-49071 |
medium | 6.5 | 0.0031 | 2026-06-17 | Unauthenticated Broken Authentication in WooCommerce Dropshipping <= 5.2.4 versions. | |
CVE-2026-54817 |
medium | 6.5 | 0.0025 | 2026-06-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API all | |
CVE-2026-57698 |
medium | 6.5 | 0.0036 | 2026-07-13 | Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart | |
CVE-2026-47481 |
medium | 6.5 | 0.0044 | 2026-07-14 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an aut | |
CVE-2026-59524 |
medium | 6.5 | 0.0042 | 2026-07-23 | Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions. | |
CVE-2026-66425 |
medium | 6.5 | 0.0042 | 2026-08-06 | Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Bo | |
CVE-2026-66451 |
medium | 6.5 | 0.0033 | 2026-08-06 | Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. | |
CVE-2026-73379 |
medium | 6.5 | 0.0029 | 2026-08-18 | Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | |
CVE-2026-73398 |
medium | 6.5 | 0.0042 | 2026-08-18 | Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions. | |
CVE-2026-73399 |
medium | 6.5 | 0.0042 | 2026-08-18 | Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions. | |
CVE-2026-84923 |
medium | 6.5 | 0.0031 | 2026-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification | |
CVE-2026-96385 |
medium | 6.5 | 0.0028 | 2026-10-22 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Aut | |
CVE-2026-118681 |
medium | 6.3 | 0.0024 | 2026-10-28 | go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls | |
CVE-2025-13013 |
medium | 6.1 | 0.0022 | 2025-11-11 | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 145, Fi | |
CVE-2026-42303 |
medium | 6.1 | 0.0031 | 2026-05-12 | Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployment | |
CVE-2026-83787 |
medium | 5.5 | 0.0033 | 2026-10-13 | Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker | |
CVE-2026-85865 |
medium | 5.5 | 0.0029 | 2026-10-13 | Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security fe | |
CVE-2026-8321 |
medium | 5.5 | 0.0041 | 2026-05-11 | A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function creat | |
CVE-2026-57980 |
medium | 5.4 | 0.0039 | 2026-07-17 | Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows a | |
CVE-2026-8990 |
medium | 5.3 | 0.0021 | 2026-05-28 | A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile a | |
CVE-2026-40799 |
medium | 5.3 | 0.0031 | 2026-06-15 | Unauthenticated Broken Authentication in Simple Cloudflare Turnstile <= 1.38.0 versions. |