Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-60672 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60696 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60698 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-60721 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg | |
CVE-2026-60782 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmissio | |
CVE-2026-60821 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Busi | |
CVE-2026-60858 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Secu | |
CVE-2026-70926 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notific | |
CVE-2026-70953 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Applicat | |
CVE-2026-70954 |
critical | 9.8 | 0.0051 | 2026-08-18 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Applicat | |
CVE-2026-76578 |
critical | 9.8 | 0.0121 | 2026-09-07 | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does | |
CVE-2025-70520 |
critical | 9.8 | 0.0050 | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authenticati | |
CVE-2026-101484 |
critical | 9.8 | 0.0054 | 2026-10-20 | Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are | |
CVE-2026-101521 |
critical | 9.8 | 0.0058 | 2026-10-20 | Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0- | |
CVE-2026-91665 |
critical | 9.8 | 0.0047 | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 2 | |
CVE-2026-46651 |
critical | 9.8 | 0.0038 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-105192 |
critical | 9.8 | 0.0077 | 2026-10-07 | LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so w | 1 PoC |
CVE-2026-57169 |
critical | 9.6 | 0.0030 | 2026-10-16 | Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endp | |
CVE-2026-46789 |
critical | 9.6 | 0.0042 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-71319 |
critical | 9.6 | 0.0063 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (developm | |
CVE-2026-12046 |
critical | 9.5 | 0.0104 | 2026-06-19 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_i | |
CVE-2026-90465 |
critical | 9.4 | 0.0024 | 2026-10-27 | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positio | |
CVE-2026-112197 |
critical | 9.4 | 0.0038 | 2026-10-28 | Vulnerability due to a lack of authentication in critical functions of the NoviGest Desktop App's Ja | |
CVE-2026-63190 |
critical | 9.4 | 0.0054 | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior | |
CVE-2026-50516 |
critical | 9.4 | 0.0083 | 2026-08-11 | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to eleva | |
CVE-2026-3893 |
critical | 9.4 | 0.0037 | 2026-04-28 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker with netw | |
CVE-2026-44592 |
critical | 9.4 | 0.0016 | 2026-05-14 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (th | |
CVE-2026-11535 |
critical | 9.4 | 0.0015 | 2026-06-12 | An unauthorized access vulnerability exists in the PcSuite APP. The vulnerability can be exploited b | |
CVE-2026-61186 |
critical | 9.4 | 0.0041 | 2026-07-21 | Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (compon | |
CVE-2026-61203 |
critical | 9.4 | 0.0046 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (component: Exp | |
CVE-2026-73296 |
critical | 9.4 | 0.0365 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t | |
CVE-2026-111811 |
critical | 9.4 | 0.0036 | 2026-10-21 | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, a | |
CVE-2023-53969 |
critical | 9.3 | 0.0051 | 2025-12-22 | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attacker | |
CVE-2023-54342 |
critical | 9.3 | 0.0046 | 2026-05-05 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the | |
CVE-2023-54344 |
critical | 9.3 | 0.0055 | 2026-05-05 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows un | |
CVE-2026-114108 |
critical | 9.3 | 0.0053 | 2026-10-21 | HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allo | |
CVE-2026-118690 |
critical | 9.3 | 0.0069 | 2026-10-28 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenti | |
CVE-2025-40765 |
critical | 9.3 | 0.0053 | 2025-10-14 | A vulnerability has been identified in TeleControl Server Basic V3.1 (All versions >= V3.1.2.2 < V3. | |
CVE-2025-40771 |
critical | 9.3 | 0.0053 | 2025-10-14 | A vulnerability has been identified in SIMATIC CP 1542SP-1 (6GK7542-6UX00-0XE0) (All versions < V2.4 | |
CVE-2026-0625 |
critical | 9.3 | 0.0097 | 2026-01-05 | Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vul | |
CVE-2026-0650 |
critical | 9.3 | 0.0152 | 2026-01-07 | OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in t | |
CVE-2026-22679 |
critical | 9.3 | 0.2036 | 2026-04-07 | Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code exec | |
CVE-2026-4810 |
critical | 9.3 | 0.0182 | 2026-04-13 | A Code Injection and Missing Authentication vulnerability in Google Agent Development Kit (ADK) vers | |
CVE-2026-6348 |
critical | 9.3 | 0.0018 | 2026-04-16 | WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability, allowing | |
CVE-2026-23751 |
critical | 9.3 | 0.0088 | 2026-04-23 | Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) | |
CVE-2026-25775 |
critical | 9.3 | 0.0040 | 2026-04-24 | A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval and update | |
CVE-2026-40620 |
critical | 9.3 | 0.0055 | 2026-04-24 | A vulnerability in SenseLive X3050’s embedded management service allows full administrative control | |
CVE-2026-41940 |
critical | 9.3 | 0.9853 | 2026-04-29 | WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass | KEV |
CVE-2026-46912 |
critical | 9.3 | 0.0027 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Run | |
CVE-2026-55450 |
critical | 9.3 | 0.0119 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unaut |