Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-3902 |
high | 7.5 | 0.0044 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `ASGIRequest` | |
CVE-2026-28954 |
high | 7.5 | 0.0039 | 2026-05-11 | A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and | |
CVE-2026-27089 |
high | 7.5 | 0.0027 | 2026-06-15 | Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. | |
CVE-2026-8651 |
high | 7.5 | 0.0037 | 2026-07-08 | Limited authentication bypass by spoofing vulnerability in Progress MOVEit Transfer (HTTPS module). | |
CVE-2026-49353 |
high | 7.5 | 0.0034 | 2026-07-15 | 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local- | |
CVE-2026-63683 |
high | 7.5 | 0.0039 | 2026-07-22 | Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions man | |
CVE-2026-64797 |
high | 7.5 | 0.0035 | 2026-07-22 | Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trus | |
CVE-2026-108131 |
high | 7.5 | 0.0086 | 2026-10-13 | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacke | |
CVE-2026-16404 |
high | 7.4 | 0.0027 | 2026-07-21 | Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. | |
CVE-2026-6090 |
high | 7.3 | 0.0011 | 2026-06-10 | A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow | |
CVE-2026-18639 |
high | 7.3 | 0.0039 | 2026-08-11 | When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a | |
CVE-2026-6387 |
high | 7.3 | 0.0018 | 2026-08-13 | A potential authentication bypass vulnerability was reported in Lenovo System Update that could allo | |
CVE-2026-39959 |
high | 7.1 | 0.0012 | 2026-04-09 | Tmds.DBus provides .NET libraries for working with D-Bus from .NET. Tmds.DBus and Tmds.DBus.Protocol | |
CVE-2026-7422 |
high | 7.1 | 0.0018 | 2026-04-29 | Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent netw | |
CVE-2026-50141 |
high | 7.1 | 0.0043 | 2026-06-18 | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability | |
CVE-2026-3183 |
high | 7.1 | 0.0121 | 2026-07-21 | Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authent | |
CVE-2026-72809 |
high | 7.1 | 0.0030 | 2026-08-12 | SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the | |
CVE-2026-114640 |
high | 7.0 | 0.0019 | 2026-10-22 | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes | |
CVE-2026-57210 |
high | 7.0 | 0.0031 | 2026-10-23 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to versio | |
CVE-2026-39999 |
high | 7.0 | 0.0063 | 2026-06-19 | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypas | |
CVE-2026-70381 |
medium | 6.9 | 0.0026 | 2026-10-26 | An access-control vulnerability has been identified in the web server configuration. Some resources | |
CVE-2026-40460 |
medium | 6.9 | 0.0037 | 2026-05-13 | When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may b | |
CVE-2026-24000 |
medium | 6.9 | 0.0043 | 2026-05-14 | Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-suppl | |
CVE-2026-46356 |
medium | 6.9 | 0.0028 | 2026-05-14 | Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's | |
CVE-2026-61428 |
medium | 6.9 | 0.0031 | 2026-07-11 | PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing una | |
CVE-2026-7656 |
medium | 6.8 | 0.0033 | 2026-06-29 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, | |
CVE-2026-5792 |
medium | 6.5 | 0.0021 | 2026-06-12 | Authentication bypass by spoofing vulnerability in Hedef Media Promotion Interactive Media Marketing | |
CVE-2026-42662 |
medium | 6.5 | 0.0032 | 2026-06-15 | Unauthenticated Bypass Vulnerability in Event Tickets <= 5.27.5 versions. | |
CVE-2026-13985 |
medium | 6.5 | 0.0028 | 2026-06-30 | Inappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a remot | |
CVE-2026-14118 |
medium | 6.5 | 0.0030 | 2026-06-30 | Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at | |
CVE-2026-14381 |
medium | 6.5 | 0.0026 | 2026-07-01 | Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.46 allowed a remote att | |
CVE-2026-45489 |
medium | 6.5 | 0.0088 | 2026-07-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | |
CVE-2026-64875 |
medium | 6.5 | 0.0036 | 2026-07-23 | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups tr | |
CVE-2026-11922 |
medium | 6.5 | 0.0022 | 2026-07-24 | A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-l | |
CVE-2026-86391 |
medium | 6.4 | 0.0038 | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS20 | |
CVE-2026-61217 |
medium | 6.4 | 0.0014 | 2026-07-21 | Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle | |
CVE-2026-107147 |
medium | 6.3 | 0.0039 | 2026-10-27 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoo | |
CVE-2026-6762 |
medium | 6.3 | 0.0016 | 2026-04-21 | Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firef | |
CVE-2026-54308 |
medium | 6.3 | 0.0030 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent36 | |
CVE-2026-56360 |
medium | 6.3 | 0.0031 | 2026-07-08 | n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in | |
CVE-2026-111623 |
medium | 6.3 | 0.0046 | 2026-10-16 | Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows | |
CVE-2026-18677 |
medium | 6.0 | 0.0058 | 2026-08-12 | In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives fro | |
CVE-2026-52690 |
medium | 5.9 | 0.0043 | 2026-06-25 | Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, cau | |
CVE-2026-6181 |
medium | 5.9 | 0.0039 | 2026-08-11 | The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can onl | |
CVE-2026-83864 |
medium | 5.5 | 0.0038 | 2026-10-13 | Improper access control in Windows NTFS allows an authorized attacker to disclose information locall | |
CVE-2026-28849 |
medium | 5.5 | 0.0016 | 2026-07-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Son | |
CVE-2026-28900 |
medium | 5.5 | 0.0016 | 2026-07-27 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia | |
CVE-2026-73995 |
medium | 5.4 | 0.0036 | 2026-08-18 | Subscriber Broken Authentication in User Registration <= 5.2.6 versions. | |
CVE-2026-93627 |
medium | 5.3 | 0.0027 | 2026-10-23 | An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration S | |
CVE-2026-93628 |
medium | 5.3 | 0.0027 | 2026-10-23 | An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Su |