Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-8697 |
high | 8.7 | 0.0051 | 2026-05-28 | Due to improper enforcement of authentication rate-limiting on a debug SSH service in Archer C64 v1, | |
CVE-2026-53869 |
high | 8.7 | 0.0059 | 2026-06-17 | Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows | |
CVE-2026-13007 |
high | 8.7 | 0.0061 | 2026-06-23 | Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose | |
CVE-2026-1840 |
high | 8.7 | 0.0071 | 2026-06-24 | The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of | |
CVE-2026-58375 |
high | 8.7 | 0.0063 | 2026-06-30 | JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the | |
CVE-2026-63101 |
high | 8.7 | 0.0052 | 2026-07-17 | Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthe | |
CVE-2026-12989 |
high | 8.7 | 0.0031 | 2026-07-27 | A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows a | |
CVE-2026-54365 |
high | 8.7 | 0.0037 | 2026-07-30 | CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll | |
CVE-2026-69111 |
high | 8.7 | 0.0110 | 2026-08-05 | Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that all | |
CVE-2026-53977 |
high | 8.7 | 0.0097 | 2026-08-06 | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remot | |
CVE-2026-53985 |
high | 8.7 | 0.0071 | 2026-08-06 | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Soc | |
CVE-2026-70559 |
high | 8.7 | 0.0045 | 2026-08-06 | Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @S | |
CVE-2026-73673 |
high | 8.7 | 0.0054 | 2026-08-14 | Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability tha | |
CVE-2026-75479 |
high | 8.7 | 0.0046 | 2026-08-17 | JimuReport contains an authentication bypass vulnerability in the report folder template listing end | |
CVE-2026-63722 |
high | 8.7 | 0.0133 | 2026-08-19 | ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthentic | |
CVE-2026-110838 |
high | 8.7 | 0.0033 | 2026-10-14 | FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state | |
CVE-2026-111613 |
high | 8.7 | 0.0059 | 2026-10-16 | AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote at | |
CVE-2026-110825 |
high | 8.7 | 0.0041 | 2026-10-22 | The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP | |
CVE-2026-77052 |
high | 8.7 | 0.0033 | 2026-10-26 | boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Cadd | |
CVE-2026-77053 |
high | 8.7 | 0.0025 | 2026-10-26 | boneIO Black firmware ships with authentication disabled by default. Its management web API listens | |
CVE-2024-58300 |
high | 8.7 | 0.0041 | 2025-12-11 | Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticated vulnerability tha | |
CVE-2026-92744 |
high | 8.7 | — | 2026-10-29 | Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execut | |
CVE-2024-35585 |
high | 8.6 | 0.0045 | 2026-09-02 | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. | |
CVE-2026-91267 |
high | 8.6 | 0.0029 | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interop | |
CVE-2026-61542 |
high | 8.6 | 0.0031 | 2026-10-28 | Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP | |
CVE-2026-113387 |
high | 8.6 | 0.0029 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, rel | |
CVE-2026-4436 |
high | 8.6 | 0.0045 | 2026-04-09 | A low-privileged remote attacker can send Modbus packets to manipulate register values that are inp | |
CVE-2026-57206 |
high | 8.6 | 0.0096 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-g | |
CVE-2026-60235 |
high | 8.6 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The s | |
CVE-2026-60356 |
high | 8.6 | 0.0041 | 2026-07-21 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic | |
CVE-2026-60359 |
high | 8.6 | 0.0041 | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Co | |
CVE-2026-60671 |
high | 8.6 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (co | |
CVE-2026-72535 |
high | 8.6 | 0.0057 | 2026-08-11 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remo | |
CVE-2026-72536 |
high | 8.6 | 0.0057 | 2026-08-11 | A missing authentication vulnerability in Chaskiq through commit 46dfdd1 allows unauthenticated remo | |
CVE-2026-56677 |
high | 8.6 | 0.0037 | 2026-08-17 | 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint i | |
CVE-2026-91534 |
high | 8.6 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (co | |
CVE-2026-56837 |
high | 8.6 | 0.0019 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's L | |
CVE-2025-15620 |
high | 8.6 | 0.0051 | 2026-04-02 | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-o | |
CVE-2026-33788 |
high | 8.5 | 0.0011 | 2026-04-09 | A Missing Authentication for Critical Function vulnerability in the Flexible PIC Concentrators (FPCs | |
CVE-2026-6272 |
high | 8.5 | 0.0032 | 2026-04-24 | A client holding only a read JWT scope can still register itself as a signal provider through the pr | |
CVE-2026-9045 |
high | 8.5 | 0.0010 | 2026-06-10 | During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessori | |
CVE-2026-75060 |
high | 8.4 | 0.0018 | 2026-08-17 | In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP too | |
CVE-2026-55786 |
high | 8.4 | 0.0026 | 2026-10-14 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, | |
CVE-2026-49471 |
high | 8.3 | 0.0037 | 2026-07-07 | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilitie | |
CVE-2026-56675 |
high | 8.3 | 0.0050 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted a | |
CVE-2026-114092 |
high | 8.3 | 0.0059 | 2026-10-21 | Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of t | |
CVE-2026-83398 |
high | 8.2 | 0.0032 | 2026-10-20 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Tra | |
CVE-2026-91358 |
high | 8.2 | 0.0032 | 2026-10-20 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (c | |
CVE-2026-45089 |
high | 8.2 | 0.0024 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe | |
CVE-2026-45327 |
high | 8.2 | 0.0036 | 2026-06-05 | TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authent |