Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-116863 |
critical | 9.6 | 0.0018 | 2026-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite a | |
CVE-2026-46786 |
critical | 9.6 | 0.0021 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-61097 |
critical | 9.6 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Ser | |
CVE-2026-57784 |
critical | 9.6 | 0.0020 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 v | |
CVE-2026-65471 |
critical | 9.6 | 0.0020 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions. | |
CVE-2026-70376 |
critical | 9.6 | 0.0020 | 2026-08-05 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in da | |
CVE-2026-44364 |
critical | 9.3 | 0.0019 | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. In 3.0.7 and e | |
CVE-2026-46785 |
critical | 9.3 | 0.0020 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60631 |
critical | 9.3 | 0.0020 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-15747 |
critical | 9.1 | 0.0025 | 2026-07-14 | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CS | |
CVE-2026-61204 |
critical | 9.0 | 0.0018 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle PeopleSoft (comp | |
CVE-2024-30855 |
high | 8.8 | 0.0022 | 2025-12-29 | DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/de | |
CVE-2026-116838 |
high | 8.8 | 0.0038 | 2026-10-27 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Req | |
CVE-2026-111120 |
high | 8.8 | 0.0032 | 2026-10-28 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request | |
CVE-2026-92797 |
high | 8.8 | 0.0015 | 2026-10-28 | The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, | |
CVE-2023-22691 |
high | 8.8 | 0.0027 | 2023-05-03 | Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific | |
CVE-2022-45846 |
high | 8.8 | 0.0025 | 2023-05-10 | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive | |
CVE-2023-30901 |
high | 8.8 | 0.0036 | 2023-06-13 | A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.11), SICAM | |
CVE-2025-65840 |
high | 8.8 | 0.0018 | 2025-12-01 | PublicCMS V5.202506.b is vulnerable to Cross Site Request Forgery (CSRF) in the CkEditorAdminControl | |
CVE-2026-42289 |
high | 8.8 | 0.0015 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user | |
CVE-2026-22342 |
high | 8.8 | 0.0018 | 2026-06-17 | Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions. | |
CVE-2026-57659 |
high | 8.8 | 0.0020 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <= | |
CVE-2026-52784 |
high | 8.8 | 0.0024 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there | |
CVE-2026-57766 |
high | 8.8 | 0.0020 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 ver | |
CVE-2026-57786 |
high | 8.8 | 0.0023 | 2026-07-13 | Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows A | |
CVE-2026-60025 |
high | 8.8 | 0.0020 | 2026-07-17 | Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extens | |
CVE-2026-60633 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60634 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60635 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60636 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60637 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60638 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60639 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60664 |
high | 8.8 | 0.0021 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-63280 |
high | 8.8 | 0.0020 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular La | |
CVE-2026-63684 |
high | 8.8 | 0.0020 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various ad | |
CVE-2026-64791 |
high | 8.8 | 0.0020 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular La | |
CVE-2026-64876 |
high | 8.8 | 0.0020 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP ext | |
CVE-2026-57785 |
high | 8.8 | 0.0020 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions. | |
CVE-2026-65944 |
high | 8.8 | 0.0020 | 2026-07-29 | Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0 | |
CVE-2026-2482 |
high | 8.8 | 0.0015 | 2026-07-29 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site req | |
CVE-2026-28813 |
high | 8.8 | 0.0027 | 2026-07-30 | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. | |
CVE-2026-69082 |
high | 8.8 | 0.0027 | 2026-08-03 | CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deleti | |
CVE-2026-60009 |
high | 8.8 | 0.0044 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f | |
CVE-2026-7326 |
high | 8.8 | 0.0021 | 2026-08-05 | A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3. | |
CVE-2026-70432 |
high | 8.8 | 0.0030 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and | |
CVE-2026-72578 |
high | 8.8 | 0.0026 | 2026-08-10 | A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticate | |
CVE-2026-73222 |
high | 8.8 | 0.0032 | 2026-08-11 | Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the | |
CVE-2026-66602 |
high | 8.8 | 0.0020 | 2026-08-18 | Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar all | |
CVE-2025-56798 |
high | 8.8 | 0.0032 | 2026-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 |