Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-3012 |
medium | 6.8 | 0.0026 | 2026-05-27 | A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto | |
CVE-2026-115910 |
medium | 6.8 | 0.0016 | 2026-10-26 | Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConn | |
CVE-2026-93008 |
medium | 6.8 | — | 2026-10-29 | A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache record | |
CVE-2026-44725 |
medium | 6.6 | 0.0037 | 2026-08-20 | EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to vers | |
CVE-2026-53899 |
medium | 6.5 | 0.0010 | 2026-06-16 | Firefox for iOS used partial domain matching when attaching cookies to PDF requests, allowing a mali | |
CVE-2026-54288 |
medium | 6.5 | 0.0015 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-47155 |
medium | 6.5 | 0.0025 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, vLLM's re | |
CVE-2026-48816 |
medium | 6.5 | 0.0014 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @s | |
CVE-2026-33731 |
medium | 6.5 | 0.0016 | 2026-07-16 | WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook h | |
CVE-2026-50248 |
medium | 6.5 | 0.0013 | 2026-07-22 | In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured prima | |
CVE-2026-49331 |
medium | 6.5 | 0.0019 | 2026-08-05 | A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-r | |
CVE-2026-19127 |
medium | 6.5 | 0.0031 | 2026-08-06 | An issue in the billing and license activation subsystem allows remote attackers to bypass payment a | |
CVE-2026-91588 |
medium | 6.5 | 0.0015 | 2026-10-20 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (co | |
CVE-2026-7606 |
medium | 6.3 | 0.0023 | 2026-05-02 | A weakness has been identified in TRENDnet TEW-821DAP 1.12B01. This issue affects the function find_ | |
CVE-2026-7611 |
medium | 6.3 | 0.0023 | 2026-05-02 | A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01. This impacts the function platform_d | |
CVE-2026-44308 |
medium | 6.3 | 0.0018 | 2026-05-14 | Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. Fro | |
CVE-2026-104381 |
medium | 6.0 | 0.0013 | 2026-10-27 | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature al | |
CVE-2026-3446 |
medium | 6.0 | 0.0019 | 2026-04-10 | When calling base64.b64decode() or related functions the decoding process would stop after encounter | |
CVE-2026-46538 |
medium | 5.9 | 0.0022 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-13188 |
medium | 5.9 | 0.0016 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tamp | |
CVE-2026-19941 |
medium | 5.9 | 0.0023 | 2026-09-16 | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, | |
CVE-2026-42206 |
medium | 5.7 | 0.0015 | 2026-05-08 | Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, | |
CVE-2026-102682 |
medium | 5.6 | 0.0023 | 2026-10-14 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa | |
CVE-2026-115408 |
medium | 5.5 | 0.0008 | 2026-10-27 | In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pa | |
CVE-2026-103359 |
medium | 5.3 | 0.0011 | 2026-10-27 | The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenti | |
CVE-2026-103313 |
medium | 5.3 | 0.0016 | 2026-10-28 | The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider | |
CVE-2026-103330 |
medium | 5.3 | 0.0016 | 2026-10-28 | The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of inc | |
CVE-2026-44087 |
medium | 5.3 | 0.0028 | 2026-06-19 | Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect p | |
CVE-2026-44434 |
medium | 5.3 | 0.0021 | 2026-07-16 | Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server | |
CVE-2026-62517 |
medium | 5.3 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Int | |
CVE-2026-28145 |
medium | 5.3 | 0.0016 | 2026-07-31 | Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allow | |
CVE-2026-103300 |
medium | 5.3 | 0.0011 | 2026-10-26 | The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payme | |
CVE-2026-62215 |
medium | 5.1 | 0.0025 | 2026-07-17 | OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability in HTTP Canvas resp | |
CVE-2026-48783 |
medium | 4.8 | 0.0017 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated | |
CVE-2026-21078 |
medium | 4.7 | 0.0016 | 2026-08-10 | Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to versio | |
CVE-2026-53900 |
medium | 4.3 | 0.0010 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects | |
CVE-2026-59930 |
medium | 4.3 | 0.0019 | 2026-07-08 | Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the toc plugin and T | |
CVE-2026-110510 |
low | 3.5 | 0.0011 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag set | |
CVE-2026-40109 |
low | 3.1 | 0.0013 | 2026-04-09 | Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolk | |
CVE-2026-6986 |
low | 2.9 | 0.0022 | 2026-04-25 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the fu | |
CVE-2026-7689 |
low | 2.9 | 0.0014 | 2026-05-03 | A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the | |
CVE-2026-115183 |
low | 2.4 | 0.0009 | 2026-10-25 | The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's hea | |
CVE-2026-13507 |
low | 2.3 | 0.0018 | 2026-06-28 | A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to | |
CVE-2026-62995 |
low | 2.3 | 0.0014 | 2026-07-29 | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encry | |
CVE-2026-68554 |
low | 2.3 | 0.0019 | 2026-08-19 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path att | |
CVE-2026-116608 |
low | 2.1 | 0.0015 | 2026-10-27 | A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by this i | |
CVE-2026-13483 |
low | 1.3 | 0.0013 | 2026-06-28 | A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_cr | |
CVE-2026-13513 |
low | 1.3 | 0.0018 | 2026-06-29 | A security flaw has been discovered in MyScale MyScaleDB up to 1.8.0. This vulnerability affects the | |
CVE-2026-110952 |
— | — | 0.0012 | 2026-10-28 | A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed valida | |
CVE-2026-110985 |
— | — | 0.0013 | 2026-10-28 | A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.cla |