Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-56451 |
critical | 10.0 | 0.0050 | 2026-07-14 | A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do n | |
CVE-2026-72889 |
critical | 9.8 | 0.0045 | 2026-08-19 | Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verif | |
CVE-2026-62873 |
critical | 9.8 | 0.0061 | 2026-08-06 | Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorize | |
CVE-2026-59243 |
critical | 9.8 | 0.0064 | 2026-07-29 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID | |
CVE-2026-18108 |
critical | 9.8 | 0.0031 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_asser | |
CVE-2026-10579 |
critical | 9.8 | 0.0046 | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged | |
CVE-2026-28148 |
critical | 9.8 | 0.0034 | 2026-08-13 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | |
CVE-2026-58426 |
critical | 9.6 | 0.0023 | 2026-07-03 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross | |
CVE-2026-15265 |
critical | 9.4 | 0.0056 | 2026-07-14 | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged atta | |
CVE-2026-117601 |
critical | 9.3 | 0.0018 | 2026-10-27 | Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool trans | |
CVE-2026-62834 |
critical | 9.3 | 0.0053 | 2026-08-20 | Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attack | |
CVE-2026-6911 |
critical | 9.3 | 0.0025 | 2026-04-24 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT to | |
CVE-2026-46423 |
critical | 9.3 | 0.0022 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-22097 |
critical | 9.3 | 0.0033 | 2026-07-13 | The firmware update mechanism does not include cryptographic signature validation. This allows anyon | |
CVE-2026-54733 |
critical | 9.3 | 0.0088 | 2026-07-16 | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Dire | |
CVE-2026-116116 |
critical | 9.3 | 0.0009 | 2026-10-26 | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown function o | |
CVE-2026-46713 |
critical | 9.2 | 0.0028 | 2026-08-03 | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to | |
CVE-2026-105869 |
critical | 9.2 | 0.0030 | 2026-10-21 | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a | |
CVE-2026-96252 |
critical | 9.1 | 0.0056 | 2026-10-13 | Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) all | |
CVE-2026-42193 |
critical | 9.1 | 0.0013 | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, the /webhook | |
CVE-2026-33117 |
critical | 9.1 | 0.0048 | 2026-05-12 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptograph | |
CVE-2026-44699 |
critical | 9.1 | 0.0026 | 2026-05-15 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that does not c | |
CVE-2026-49454 |
critical | 9.1 | 0.0023 | 2026-06-18 | Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0 | |
CVE-2026-48021 |
critical | 9.1 | 0.0019 | 2026-07-24 | In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between ep | |
CVE-2026-9487 |
critical | 9.1 | 0.0028 | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() | |
CVE-2026-7557 |
critical | 9.1 | 0.0046 | 2026-08-05 | An improper verification of cryptographic signature vulnerability in the SAML authentication module | |
CVE-2026-10141 |
critical | 9.1 | 0.0028 | 2026-10-20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000R (version | |
CVE-2026-85818 |
critical | 9.0 | 0.0041 | 2026-10-13 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker | |
CVE-2026-96957 |
high | 8.8 | 0.0053 | 2026-10-13 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a | |
CVE-2026-64623 |
high | 8.8 | 0.0026 | 2026-07-20 | Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in | |
CVE-2026-65616 |
high | 8.8 | 0.0037 | 2026-07-27 | Incorrect authorization validation in refresh token signature allows non-admin users to obtain a sig | |
CVE-2026-76234 |
high | 8.7 | 0.0031 | 2026-08-19 | libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic i | |
CVE-2026-63571 |
high | 8.7 | 0.0017 | 2026-10-02 | Improper verification of cryptographic signature in the attribute certificate path validator (PkixAt | |
CVE-2026-52754 |
high | 8.7 | 0.0025 | 2026-06-10 | Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authen | |
CVE-2026-80465 |
high | 8.7 | 0.0028 | 2026-09-03 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), M | |
CVE-2026-117602 |
high | 8.6 | 0.0011 | 2026-10-27 | Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which ex | |
CVE-2026-13722 |
high | 8.6 | 0.0033 | 2026-07-03 | WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the | |
CVE-2026-10754 |
high | 8.6 | 0.0078 | 2026-08-10 | Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic | |
CVE-2026-56837 |
high | 8.6 | 0.0019 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's L | |
CVE-2026-54736 |
high | 8.2 | 0.0018 | 2026-07-10 | Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt:: | |
CVE-2026-49998 |
high | 8.2 | 0.0022 | 2026-07-16 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic | |
CVE-2026-55735 |
high | 8.2 | 0.0046 | 2026-08-01 | Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated att | |
CVE-2026-47304 |
high | 8.1 | 0.0029 | 2026-07-14 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a | |
CVE-2026-102866 |
high | 8.1 | 0.0067 | 2026-10-13 | Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthoriz | |
CVE-2026-40070 |
high | 8.1 | 0.0014 | 2026-04-09 | BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.3.1 to before 0.8.2, BSV::Wallet::Wallet | |
CVE-2026-42602 |
high | 8.1 | 0.0022 | 2026-05-13 | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side auth | |
CVE-2026-11348 |
high | 8.1 | 0.0025 | 2026-07-07 | Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fak | |
CVE-2026-18092 |
high | 8.1 | 0.0034 | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping | |
CVE-2026-15556 |
high | 8.1 | 0.0033 | 2026-08-11 | A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion | |
CVE-2026-41431 |
high | 8.0 | 0.0020 | 2026-05-11 | Zen is a firefox-based browser. Prior to 1.19.9b, Zen Browser ships a Mozilla Application Resource ( |