Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-28564 |
critical | 9.8 | 0.0068 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoT | |
CVE-2026-56453 |
critical | 9.8 | 0.0035 | 2026-07-16 | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remot | |
CVE-2026-68079 |
critical | 9.8 | 0.0068 | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an | |
CVE-2026-26232 |
critical | 9.1 | 0.0050 | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry and single | |
CVE-2026-53431 |
critical | 9.1 | 0.0051 | 2026-07-30 | Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has | |
CVE-2026-53424 |
critical | 9.1 | 0.0060 | 2026-08-20 | Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authent | |
CVE-2026-116201 |
high | 8.7 | 0.0030 | 2026-10-25 | Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse | |
CVE-2026-34021 |
high | 8.6 | 0.0020 | 2026-06-15 | The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 com | |
CVE-2026-116825 |
high | 8.3 | 0.0022 | 2026-10-27 | YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), | |
CVE-2026-35149 |
high | 8.2 | 0.0042 | 2026-07-16 | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side auth | |
CVE-2026-62911 |
high | 8.0 | 0.0069 | 2026-08-11 | Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker t | 3 PoC |
CVE-2026-50575 |
high | 7.7 | 0.0022 | 2026-08-18 | BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly inv | |
CVE-2025-61479 |
high | 7.5 | 0.0043 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically | |
CVE-2025-61480 |
high | 7.5 | 0.0018 | 2026-08-26 | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically | |
CVE-2026-41020 |
high | 7.5 | 0.0023 | 2026-10-27 | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacke | |
CVE-2026-55759 |
high | 7.4 | 0.0032 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8 | |
CVE-2026-57574 |
high | 7.4 | 0.0055 | 2026-07-10 | Misskey is an open source, federated social media platform. Prior to 2026.6.0, Misskey contains a vu | |
CVE-2026-65824 |
high | 7.4 | 0.0025 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-20779 |
high | 7.1 | 0.0049 | 2026-07-03 | Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a vali | |
CVE-2026-72780 |
high | 7.1 | 0.0039 | 2026-08-11 | Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion valida | |
CVE-2026-49319 |
medium | 6.9 | 0.0030 | 2026-06-25 | Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured b | |
CVE-2026-47133 |
medium | 6.9 | 0.0015 | 2026-07-20 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. | |
CVE-2026-37982 |
medium | 6.8 | 0.0044 | 2026-05-19 | A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ` | |
CVE-2026-17268 |
medium | 6.8 | 0.0034 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict | |
CVE-2026-89209 |
medium | 6.8 | 0.0026 | 2026-10-26 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), M | |
CVE-2026-117470 |
medium | 6.5 | 0.0041 | 2026-10-27 | Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after | |
CVE-2026-55370 |
medium | 6.4 | 0.0034 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's | |
CVE-2026-47341 |
medium | 6.3 | 0.0069 | 2026-06-19 | Authentication Bypass by Capture-replay vulnerability in Apache APISIX. Attacker can benefit from c | |
CVE-2026-104381 |
medium | 6.0 | 0.0013 | 2026-10-27 | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature al | |
CVE-2026-27855 |
medium | 5.9 | 0.0032 | 2026-03-27 | Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache i | |
CVE-2026-46538 |
medium | 5.9 | 0.0022 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-16083 |
medium | 5.5 | 0.0072 | 2026-07-18 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhoo | |
CVE-2025-40807 |
medium | 5.3 | 0.0030 | 2025-12-09 | A vulnerability has been identified in Gridscale X Prepay (All versions < V4.2.1). The affected appl | |
CVE-2026-35141 |
medium | 5.3 | 0.0033 | 2026-07-16 | HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote | |
CVE-2026-114617 |
medium | 4.2 | 0.0023 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDMix | |
CVE-2026-87952 |
low | 3.1 | 0.0022 | 2026-10-22 | Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows | |
CVE-2026-56130 |
low | 2.0 | 0.0030 | 2026-06-25 | "Remember me" cookie age is not verified on the server. This potentially allows an attacker to inter |