Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-6213 |
critical | 10.0 | 0.0033 | 2026-05-08 | A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local | |
CVE-2026-115933 |
critical | 9.9 | 0.0025 | 2026-10-24 | Postiz signs its session, invitation and password reset tokens with one shared secret and without an | |
CVE-2026-76938 |
critical | 9.8 | 0.0064 | 2026-10-27 | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue affects J | |
CVE-2026-82117 |
critical | 9.8 | 0.0064 | 2026-10-27 | Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server Version 1 | |
CVE-2021-25827 |
critical | 9.8 | — | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header | |
CVE-2026-24270 |
critical | 9.8 | 0.0081 | 2026-07-01 | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentication. A s | |
CVE-2026-62644 |
critical | 9.8 | 0.0050 | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webm | |
CVE-2026-50755 |
critical | 9.8 | 0.0062 | 2026-07-21 | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive informat | |
CVE-2026-28812 |
critical | 9.8 | 0.0069 | 2026-07-30 | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attac | |
CVE-2026-28008 |
critical | 9.8 | 0.0061 | 2026-08-13 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions | |
CVE-2026-112241 |
critical | 9.8 | 0.0046 | 2026-10-22 | Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authent | |
CVE-2026-18972 |
critical | 9.6 | 0.0035 | 2026-08-11 | An authenticated attacker can spoof another GUI user's identity by sending their request with the cu | |
CVE-2026-49468 |
critical | 9.5 | 0.0303 | 2026-06-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84. | |
CVE-2026-90465 |
critical | 9.4 | 0.0024 | 2026-10-27 | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positio | |
CVE-2022-51026 |
critical | 9.3 | 0.0061 | 2026-10-22 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthentic | |
CVE-2026-25660 |
critical | 9.3 | 0.0045 | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyz | |
CVE-2026-49757 |
critical | 9.2 | 0.0062 | 2026-06-15 | Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows account tak | |
CVE-2026-58370 |
critical | 9.2 | 0.0072 | 2026-06-30 | Woodpecker before 3.15.0 matches the ApprovalAllowedUsers bypass list against pipeline.Author. For t | |
CVE-2026-90717 |
critical | 9.1 | 0.0023 | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS20 | |
CVE-2026-24013 |
critical | 9.1 | 0.0063 | 2026-07-06 | Authentication Bypass by Spoofing vulnerability in Apache IoTDB. Certain Thrift RPC query handlers l | |
CVE-2026-55954 |
critical | 9.1 | 0.0051 | 2026-07-14 | Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth_apple allows account takeover | |
CVE-2026-53791 |
critical | 9.1 | 0.0050 | 2026-08-13 | rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated | |
CVE-2026-105008 |
critical | 9.0 | 0.0066 | 2026-10-13 | No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a | |
CVE-2026-77903 |
critical | 9.0 | 0.0037 | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate | |
CVE-2026-33654 |
high | 8.9 | 0.0051 | 2026-03-27 | nanobot is a personal AI assistant. Prior to version 0.1.6, an indirect prompt injection vulnerabili | |
CVE-2025-30052 |
high | 8.8 | 0.0034 | 2026-10-23 | The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Acces | |
CVE-2023-32207 |
high | 8.8 | 0.0073 | 2023-06-02 | A missing delay in popup notifications could have made it possible for an attacker to trick a user i | |
CVE-2026-46414 |
high | 8.8 | 0.0059 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-16101 |
high | 8.8 | 0.0035 | 2026-08-13 | Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue d | |
CVE-2026-19291 |
high | 8.8 | 0.0035 | 2026-08-13 | Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x imp | |
CVE-2026-13207 |
high | 8.7 | 0.0061 | 2026-06-30 | FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path no | |
CVE-2026-94422 |
high | 8.7 | 0.0050 | 2026-10-02 | An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an a | |
CVE-2026-22734 |
high | 8.6 | 0.0036 | 2026-04-17 | Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user a | |
CVE-2026-53857 |
high | 8.6 | 0.0022 | 2026-06-16 | OpenClaw before 2026.5.3 contains a policy enforcement vulnerability where Zalo contacts with mutabl | |
CVE-2026-83845 |
high | 8.4 | 0.0033 | 2026-10-13 | Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to per | |
CVE-2026-56675 |
high | 8.3 | 0.0050 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted a | |
CVE-2026-24899 |
high | 8.2 | 0.0038 | 2026-05-14 | Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's | |
CVE-2026-55641 |
high | 8.2 | 0.0033 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy re | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side auth | |
CVE-2026-65570 |
high | 8.1 | 0.0040 | 2026-08-06 | Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | |
CVE-2026-64665 |
high | 8.1 | 0.0054 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, w | |
CVE-2026-46731 |
high | 7.8 | 0.0018 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentic | |
CVE-2026-59914 |
high | 7.8 | 0.0018 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentic | |
CVE-2026-59916 |
high | 7.8 | 0.0015 | 2026-08-12 | Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Acc | |
CVE-2026-45223 |
high | 7.7 | 0.0038 | 2026-05-11 | Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token v | |
CVE-2026-92546 |
high | 7.5 | 0.0030 | 2026-10-27 | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agen | |
CVE-2026-70179 |
high | 7.5 | 0.0063 | 2026-10-13 | Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privilege | |
CVE-2023-25743 |
high | 7.5 | 0.0065 | 2023-06-02 | A lack of in app notification for entering fullscreen mode could have lead to a malicious website sp | |
CVE-2026-3902 |
high | 7.5 | 0.0044 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` | |
CVE-2026-28954 |
high | 7.5 | 0.0039 | 2026-05-11 | A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and |