Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-111594 |
critical | 9.2 | 0.0019 | 2026-10-22 | InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attac | |
CVE-2026-44726 |
critical | 9.1 | 0.0023 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's | |
CVE-2026-42514 |
high | 8.8 | 0.0023 | 2026-04-29 | This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A | |
CVE-2026-100635 |
high | 8.2 | 0.0033 | 2026-09-26 | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where se | |
CVE-2026-116200 |
high | 8.2 | 0.0015 | 2026-10-25 | Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing o | |
CVE-2026-116166 |
high | 7.6 | 0.0011 | 2026-10-25 | SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so | |
CVE-2026-31923 |
high | 7.5 | 0.0025 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due | |
CVE-2026-22155 |
high | 7.5 | 0.0017 | 2026-04-14 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 thr | |
CVE-2026-41275 |
high | 7.5 | 0.0018 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-49486 |
high | 7.5 | 0.0044 | 2026-06-26 | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but n | |
CVE-2026-55844 |
high | 7.5 | 0.0020 | 2026-06-29 | Home Assistant is open source home automation software that puts local control and privacy first. Pr | |
CVE-2026-18536 |
high | 7.5 | 0.0020 | 2026-08-01 | Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data: | |
CVE-2026-6066 |
high | 7.1 | 0.0008 | 2026-04-20 | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in th | |
CVE-2026-50034 |
high | 7.1 | 0.0021 | 2026-06-19 | An attacker within BLE communication range can passively intercept wireless traffic and obtain sens | |
CVE-2026-70379 |
high | 7.1 | 0.0011 | 2026-10-26 | When the vSolution Matrix feature is enabled, affected devices may make current screen content avail | |
CVE-2026-40431 |
medium | 6.9 | 0.0019 | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencryp | |
CVE-2026-53986 |
medium | 6.9 | 0.0022 | 2026-10-21 | Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain | |
CVE-2023-23915 |
medium | 6.5 | 0.0088 | 2023-02-23 | A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could c | |
CVE-2026-21742 |
medium | 6.5 | 0.0015 | 2026-04-14 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 thr | |
CVE-2026-33569 |
medium | 6.5 | 0.0019 | 2026-04-17 | Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff | |
CVE-2026-48022 |
medium | 6.5 | 0.0018 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Au | |
CVE-2026-20294 |
medium | 6.5 | 0.0021 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow a | |
CVE-2026-116844 |
medium | 6.3 | 0.0009 | 2026-10-27 | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because Transf | |
CVE-2026-118373 |
medium | 6.3 | 0.0009 | 2026-10-28 | LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() | |
CVE-2026-41281 |
medium | 6.3 | 0.0009 | 2026-05-14 | Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensi | |
CVE-2026-19683 |
medium | 6.3 | 0.0034 | 2026-08-20 | A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During com | |
CVE-2026-116105 |
medium | 6.3 | 0.0027 | 2026-10-26 | A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of | |
CVE-2026-116114 |
medium | 6.3 | 0.0019 | 2026-10-26 | A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown functio | |
CVE-2026-116196 |
medium | 6.0 | 0.0006 | 2026-10-25 | Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the | |
CVE-2026-15806 |
medium | 6.0 | 0.0053 | 2026-08-18 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWit | |
CVE-2026-115495 |
medium | 5.7 | 0.0008 | 2026-10-27 | Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL | |
CVE-2026-34346 |
medium | 5.5 | 0.0027 | 2026-07-14 | Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock all | |
CVE-2026-31924 |
medium | 5.3 | 0.0024 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls l | |
CVE-2026-53624 |
medium | 4.8 | 0.0021 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in m | |
CVE-2026-107692 |
medium | 4.8 | 0.0014 | 2026-10-20 | The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first d | |
CVE-2026-4820 |
medium | 4.3 | 0.0012 | 2026-04-01 | IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authoriza | |
CVE-2026-3182 |
medium | 4.3 | 0.0065 | 2026-07-21 | Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transm | |
CVE-2026-7610 |
low | 2.9 | 0.0032 | 2026-05-02 | A vulnerability has been found in TRENDnet TEW-821DAP 1.12B01. This affects an unknown function of t | |
CVE-2026-115797 |
low | 2.9 | 0.0020 | 2026-10-23 | A weakness has been identified in Tenda F6 12.02.01.73. Affected is an unknown function of the compo | |
CVE-2026-21812 |
low | 2.2 | 0.0014 | 2026-10-22 | HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vul | |
CVE-2026-48978 |
low | 2.1 | 0.0021 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm UR |