Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2612)
CWE-79 (1785)
CWE-416 (1279)
CWE-862 (1161)
CWE-89 (1089)
CWE-22 (1005)
CWE-125 (861)
CWE-200 (838)
CWE-306 (831)
CWE-122 (821)
CWE-20 (786)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (601)
CWE-74 (599)
CWE-639 (533)
CWE-400 (512)
CWE-269 (499)
CWE-119 (494)
CWE-770 (429)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (320)
CWE-352 (271)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-43914 |
critical | 9.8 | 0.0029 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security v | |
CVE-2026-6853 |
critical | 9.8 | 0.0035 | 2026-06-12 | Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe | |
CVE-2026-45010 |
critical | 9.3 | 0.0043 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerab | |
CVE-2026-35675 |
high | 8.8 | 0.0042 | 2026-05-28 | phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint | |
CVE-2023-54347 |
high | 8.7 | 0.0054 | 2026-05-05 | OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass r | |
CVE-2026-41037 |
high | 8.7 | 0.0020 | 2026-04-21 | This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protec | |
CVE-2026-6947 |
high | 8.7 | 0.0057 | 2026-04-24 | DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability, al | |
CVE-2026-3329 |
high | 8.7 | 0.0045 | 2026-06-11 | A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user ac | |
CVE-2026-50176 |
high | 8.7 | 0.0071 | 2026-06-25 | The WebSocket Application Programming Interface lacks restrictions on the number of authentication r | |
CVE-2026-42952 |
high | 8.7 | 0.0054 | 2026-07-10 | Previously, there was no throttling on repeated authentication attempts to the charging station bac | |
CVE-2026-61458 |
high | 8.7 | 0.0038 | 2026-07-13 | PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoi | |
CVE-2026-65894 |
high | 8.7 | 0.0066 | 2026-07-27 | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoin | |
CVE-2026-14254 |
high | 8.3 | 0.0058 | 2026-07-16 | A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout thre | |
CVE-2025-60424 |
high | 7.6 | 0.0072 | 2025-10-27 | A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 all | |
CVE-2026-35597 |
high | 7.5 | 0.0030 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-atte | |
CVE-2026-22616 |
high | 7.5 | 0.0032 | 2026-04-16 | Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the | |
CVE-2026-40586 |
high | 7.5 | 0.0037 | 2026-04-21 | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler perfo | |
CVE-2026-65825 |
high | 7.5 | 0.0022 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-61611 |
high | 7.5 | 0.0035 | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, POST /api/v2/Album::unlock has | |
CVE-2026-33667 |
high | 7.4 | 0.0030 | 2026-04-15 | OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP v | |
CVE-2026-48084 |
high | 7.4 | 0.0039 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-55501 |
high | 7.3 | 0.0038 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/ | |
CVE-2026-32825 |
high | 7.3 | 0.0034 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-65948 |
high | 7.3 | 0.0062 | 2026-08-10 | UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0. Note: UnixAuth is NOT a | |
CVE-2026-2402 |
medium | 6.9 | 0.0027 | 2026-04-14 | CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would al | |
CVE-2026-7820 |
medium | 6.9 | 0.0021 | 2026-05-11 | Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces | |
CVE-2026-35098 |
medium | 6.9 | 0.0056 | 2026-06-30 | KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an | |
CVE-2026-8793 |
medium | 6.9 | 0.0068 | 2026-08-03 | PaperCut NG/MF does not properly restrict excessive authentication attempts within its login compone | |
CVE-2026-73529 |
medium | 6.9 | 0.0041 | 2026-08-18 | Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that | |
CVE-2026-93346 |
medium | 6.9 | 0.0033 | 2026-10-13 | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthe | |
CVE-2026-111056 |
medium | 6.9 | 0.0029 | 2026-10-19 | FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the un | |
CVE-2026-7255 |
medium | 6.5 | 0.0020 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnera | |
CVE-2026-44195 |
medium | 6.5 | 0.0032 | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNs | |
CVE-2026-71205 |
medium | 6.5 | 0.0027 | 2026-08-05 | changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 | |
CVE-2026-107145 |
medium | 6.3 | 0.0030 | 2026-10-27 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-facto | |
CVE-2026-53904 |
medium | 6.3 | 0.0034 | 2026-07-01 | MCO is vulnerable to Account Denial of Service due to improper implementation of password reset func | |
CVE-2026-62220 |
medium | 6.3 | 0.0052 | 2026-07-17 | OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass no | |
CVE-2026-116007 |
medium | 6.3 | 0.0037 | 2026-10-25 | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is t | |
CVE-2026-116123 |
medium | 6.3 | 0.0051 | 2026-10-26 | A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function valid | |
CVE-2026-41213 |
medium | 5.9 | 0.0026 | 2026-04-23 | @node-oauth/oauth2-server is a module for implementing an OAuth2 server in Node.js. The token exchan | |
CVE-2026-11915 |
medium | 5.9 | 0.0031 | 2026-07-10 | vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack | |
CVE-2026-48071 |
medium | 5.8 | 0.0040 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-15079 |
medium | 5.4 | 0.0028 | 2026-07-10 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Login Disable allo | |
CVE-2026-15586 |
medium | 5.3 | 0.0021 | 2026-10-27 | Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Cons | |
CVE-2026-33763 |
medium | 5.3 | 0.0033 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_vid | |
CVE-2026-40485 |
medium | 5.3 | 0.0034 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API log | |
CVE-2026-56450 |
medium | 5.1 | 0.0058 | 2026-06-22 | AIL did not restrict repeated failed attempts to verify a two-factor authentication (OTP) code. An a | |
CVE-2026-8285 |
medium | 4.3 | 0.0041 | 2026-07-21 | Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. F | |
CVE-2026-55977 |
low | 3.3 | 0.0013 | 2026-07-28 | Successful exploitation of this vulnerability could allow an attacker with local network access to b | |
CVE-2026-7671 |
low | 2.9 | 0.0056 | 2026-05-03 | A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impact |