Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40702 |
critical | 9.3 | 0.0065 | 2026-06-25 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate chargin | |
CVE-2026-56782 |
critical | 9.3 | 0.0356 | 2026-06-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restor | |
CVE-2026-12819 |
critical | 9.3 | 0.0054 | 2026-06-30 | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authenticat | |
CVE-2026-14162 |
critical | 9.3 | 0.0063 | 2026-06-30 | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo | |
CVE-2026-58126 |
critical | 9.3 | 0.0184 | 2026-07-01 | PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows | |
CVE-2026-58127 |
critical | 9.3 | 0.0188 | 2026-07-01 | PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerE | |
CVE-2026-58473 |
critical | 9.3 | 0.0051 | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated at | |
CVE-2026-59705 |
critical | 9.3 | 0.0064 | 2026-07-07 | mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthe | |
CVE-2026-58123 |
critical | 9.3 | 0.0465 | 2026-07-09 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that al | |
CVE-2026-22096 |
critical | 9.3 | 0.0055 | 2026-07-13 | The webserver running on port 8090 does not require authentication. This allows for sensitive inform | |
CVE-2026-6847 |
critical | 9.3 | 0.0088 | 2026-07-13 | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a cri | |
CVE-2026-59801 |
critical | 9.3 | 0.0262 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote a | |
CVE-2026-62327 |
critical | 9.3 | 0.0627 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that | |
CVE-2026-63087 |
critical | 9.3 | 0.0071 | 2026-07-16 | Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote a | |
CVE-2026-62241 |
critical | 9.3 | 0.0067 | 2026-07-17 | clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-de | |
CVE-2026-61175 |
critical | 9.3 | 0.0044 | 2026-07-21 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: I | |
CVE-2026-61884 |
critical | 9.3 | 0.0056 | 2026-07-24 | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an inst | |
CVE-2026-60112 |
critical | 9.3 | 0.0079 | 2026-07-29 | AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that | |
CVE-2026-60113 |
critical | 9.3 | 0.0083 | 2026-07-29 | AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing au | |
CVE-2026-67426 |
critical | 9.3 | 0.0037 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the stand | |
CVE-2026-67208 |
critical | 9.3 | 0.0722 | 2026-07-30 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remo | |
CVE-2026-67594 |
critical | 9.3 | 0.0085 | 2026-07-30 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthen | |
CVE-2026-41452 |
critical | 9.3 | 0.0374 | 2026-08-03 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that al | |
CVE-2026-61514 |
critical | 9.3 | 0.0083 | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability t | |
CVE-2026-69703 |
critical | 9.3 | 0.0059 | 2026-08-04 | Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_ | |
CVE-2026-70552 |
critical | 9.3 | 0.0083 | 2026-08-04 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher | |
CVE-2026-59506 |
critical | 9.3 | 0.0041 | 2026-08-13 | : Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to P | |
CVE-2026-75852 |
critical | 9.3 | 0.0066 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB | |
CVE-2026-75854 |
critical | 9.3 | 0.0089 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-pro | |
CVE-2026-77644 |
critical | 9.3 | 0.0043 | 2026-08-20 | A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliabili | |
CVE-2026-111643 |
critical | 9.3 | 0.0058 | 2026-10-16 | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauth | |
CVE-2026-19677 |
critical | 9.3 | 0.0053 | 2026-10-23 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0. | |
CVE-2026-116485 |
critical | 9.3 | 0.0235 | 2026-10-26 | danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated | |
CVE-2026-105207 |
critical | 9.3 | 0.0031 | 2026-10-04 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and externa | |
CVE-2026-93865 |
critical | 9.2 | 0.0046 | 2026-10-27 | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows | |
CVE-2026-27843 |
critical | 9.2 | 0.0052 | 2026-04-24 | A vulnerability exists in SenseLive X3050's web management interface that allows critical configurat | |
CVE-2026-41930 |
critical | 9.2 | 0.0035 | 2026-05-06 | Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-a | |
CVE-2026-49973 |
critical | 9.2 | 0.0054 | 2026-06-11 | Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows u | |
CVE-2026-55884 |
critical | 9.2 | 0.0050 | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37. | |
CVE-2026-71878 |
critical | 9.2 | 0.0086 | 2026-08-18 | Missing authentication in initial setup functionality left exposed after initial setup is completed | |
CVE-2026-111312 |
critical | 9.2 | 0.0059 | 2026-10-15 | OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /a | |
CVE-2026-87302 |
critical | 9.1 | 0.0042 | 2026-10-20 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). | |
CVE-2026-91490 |
critical | 9.1 | 0.0040 | 2026-10-20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-5300 |
critical | 9.1 | 0.0022 | 2026-04-08 | Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attacke | |
CVE-2026-40289 |
critical | 9.1 | 0.0042 | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.140 of prais | |
CVE-2026-34279 |
critical | 9.1 | 0.0044 | 2026-04-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c | |
CVE-2026-34285 |
critical | 9.1 | 0.0041 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-34286 |
critical | 9.1 | 0.0041 | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (componen | |
CVE-2026-46892 |
critical | 9.1 | 0.0040 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edward | |
CVE-2026-46910 |
critical | 9.1 | 0.0035 | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr |