Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-44523 |
critical | 10.0 | 0.0015 | 2026-05-14 | Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy i | |
CVE-2026-48781 |
critical | 9.9 | 0.0021 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration cal | |
CVE-2026-114612 |
critical | 9.9 | 0.0032 | 2026-10-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 un | |
CVE-2026-115933 |
critical | 9.9 | 0.0025 | 2026-10-24 | Postiz signs its session, invitation and password reset tokens with one shared secret and without an | |
CVE-2026-28185 |
critical | 9.8 | 0.0027 | 2026-08-13 | Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. | |
CVE-2026-33471 |
critical | 9.6 | 0.0022 | 2026-04-22 | nimiq-block contains block primitives to be used in Nimiq's Rust implementation. `SkipBlockProof::ve | |
CVE-2026-44592 |
critical | 9.4 | 0.0016 | 2026-05-14 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (th | |
CVE-2026-39324 |
critical | 9.3 | 0.0027 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Ses | |
CVE-2026-56073 |
critical | 9.3 | 0.0023 | 2026-06-19 | Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allo | |
CVE-2026-74890 |
critical | 9.3 | 0.0021 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCiph | |
CVE-2026-116116 |
critical | 9.3 | 0.0009 | 2026-10-26 | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function o | |
CVE-2026-35039 |
critical | 9.1 | 0.0021 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. From 0.0.1 to before 6.2.0, setting up a | |
CVE-2026-63687 |
critical | 9.1 | 0.0028 | 2026-08-06 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization | |
CVE-2026-65583 |
critical | 9.1 | 0.0028 | 2026-08-06 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcin | |
CVE-2026-40487 |
critical | 9.0 | 0.0022 | 2026-04-18 | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypa | |
CVE-2026-40323 |
high | 8.9 | 0.0019 | 2026-04-18 | SP1 is a zero‑knowledge virtual machine that proves the correct execution of programs compiled for t | |
CVE-2026-103402 |
high | 8.8 | 0.0020 | 2026-10-28 | An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session | |
CVE-2026-62869 |
high | 8.8 | 0.0044 | 2026-08-11 | Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to pe | |
CVE-2025-6426 |
high | 8.8 | 0.0021 | 2025-06-24 | The executable file warning did not warn users before opening files with the `terminal` extension. | |
CVE-2026-9561 |
high | 8.8 | 0.0028 | 2026-07-14 | Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the au | |
CVE-2026-56832 |
high | 8.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots | |
CVE-2026-118377 |
high | 8.7 | 0.0018 | 2026-10-28 | mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that | |
CVE-2026-71965 |
high | 8.7 | 0.0047 | 2026-08-10 | CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerabi | |
CVE-2026-115937 |
high | 8.7 | 0.0017 | 2026-10-23 | The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifi | |
CVE-2026-55103 |
high | 8.6 | 0.0020 | 2026-10-15 | Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0 | |
CVE-2026-47664 |
high | 8.6 | 0.0021 | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health da | |
CVE-2026-10079 |
high | 8.5 | 0.0019 | 2026-07-31 | A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubern | |
CVE-2026-71576 |
high | 8.5 | 0.0029 | 2026-08-10 | A flaw was found in multicluster-global-hub. The manager component improperly validates the source i | |
CVE-2026-55883 |
high | 8.3 | 0.0026 | 2026-07-10 | Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37. | |
CVE-2026-41432 |
high | 8.2 | 0.0085 | 2026-05-08 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys | |
CVE-2026-47304 |
high | 8.1 | 0.0029 | 2026-07-14 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a | |
CVE-2026-69105 |
high | 8.1 | 0.0022 | 2026-08-12 | An unauthenticated attacker may cause untrusted package content to be cached under specific conditio | |
CVE-2026-53406 |
high | 7.8 | 0.0008 | 2026-06-12 | Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows | |
CVE-2026-48799 |
high | 7.7 | 0.0022 | 2026-07-15 | Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IP | |
CVE-2026-50575 |
high | 7.7 | 0.0022 | 2026-08-18 | BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly inv | |
CVE-2026-59247 |
high | 7.6 | 0.0018 | 2026-07-29 | Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the mid | |
CVE-2026-53425 |
high | 7.6 | 0.0022 | 2026-08-20 | Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to | |
CVE-2026-35042 |
high | 7.5 | 0.0015 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not | |
CVE-2026-44690 |
high | 7.5 | 0.0015 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, insufficient validation of the RRSIG.Labels | |
CVE-2026-52688 |
high | 7.5 | 0.0018 | 2026-07-23 | RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation | |
CVE-2026-72544 |
high | 7.5 | 0.0025 | 2026-08-11 | An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticat | |
CVE-2026-55459 |
high | 7.4 | 0.0021 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-6967 |
high | 7.1 | 0.0025 | 2026-04-24 | Missing expiration, hash, and length enforcement in delegated metadata validation in awslabs/tough b | |
CVE-2026-67618 |
high | 7.1 | 0.0029 | 2026-08-04 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors | |
CVE-2026-58262 |
high | 7.1 | 0.0016 | 2026-08-07 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signat | |
CVE-2026-114050 |
high | 7.1 | 0.0020 | 2026-10-21 | vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consist | |
CVE-2026-50526 |
high | 7.0 | 0.0022 | 2026-07-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker | |
CVE-2026-45792 |
medium | 6.9 | 0.0011 | 2026-06-23 | rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.32.0, RTK | |
CVE-2026-49212 |
medium | 6.9 | 0.0024 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC comput | |
CVE-2026-116254 |
medium | 6.9 | 0.0026 | 2026-10-26 | A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. Thi |