Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2025-70517 |
high | 8.8 | 0.0020 | 2026-10-07 | The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin reso | |
CVE-2025-70522 |
high | 8.8 | 0.0020 | 2026-10-07 | The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin reso | |
CVE-2026-107084 |
high | 8.8 | 0.0020 | 2026-10-19 | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) a | |
CVE-2026-114177 |
high | 8.8 | 0.0018 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons | |
CVE-2026-111841 |
high | 8.8 | 0.0013 | 2026-10-26 | Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automatio | |
CVE-2026-116399 |
high | 8.8 | — | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cr | |
CVE-2026-86467 |
high | 8.8 | 0.0017 | 2026-10-20 | Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authenticat | |
CVE-2026-87408 |
high | 8.7 | 0.0017 | 2026-10-20 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Pe | |
CVE-2026-114089 |
high | 8.7 | 0.0020 | 2026-10-21 | Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorizatio | |
CVE-2026-114662 |
high | 8.6 | 0.0017 | 2026-10-22 | Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows | |
CVE-2026-117536 |
high | 8.6 | 0.0014 | 2026-10-27 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user adminis | |
CVE-2015-20129 |
high | 8.6 | 0.0015 | 2026-10-28 | CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to p | |
CVE-2026-54220 |
high | 8.6 | 0.0019 | 2026-06-18 | uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechani | |
CVE-2026-59713 |
high | 8.6 | 0.0023 | 2026-07-06 | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally | |
CVE-2026-75779 |
high | 8.6 | 0.0120 | 2026-10-23 | Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross | |
CVE-2026-58497 |
high | 8.6 | 0.0026 | 2026-10-23 | Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, | |
CVE-2026-32989 |
high | 8.6 | 0.0022 | 2026-03-20 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attacke | |
CVE-2026-28761 |
high | 8.5 | 0.0013 | 2026-05-15 | Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLE | |
CVE-2026-66001 |
high | 8.5 | 0.0034 | 2026-08-20 | Frappe is a full-stack web application framework. Prior to 15.114.0 and 16.26.0, the approve and aut | |
CVE-2026-27841 |
high | 8.4 | 0.0016 | 2026-04-24 | A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be | |
CVE-2026-40925 |
high | 8.3 | 0.0017 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpda | |
CVE-2026-49471 |
high | 8.3 | 0.0037 | 2026-07-07 | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilitie | |
CVE-2026-47158 |
high | 8.3 | 0.0025 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO aut | |
CVE-2026-60640 |
high | 8.3 | 0.0017 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-5219 |
high | 8.3 | 0.0018 | 2026-07-30 | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Co | |
CVE-2026-73292 |
high | 8.3 | 0.0023 | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/pas | |
CVE-2026-57655 |
high | 8.2 | 0.0017 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions. | |
CVE-2026-61101 |
high | 8.2 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (compon | |
CVE-2026-40581 |
high | 8.1 | 0.0020 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record | |
CVE-2026-44548 |
high | 8.1 | 0.0014 | 2026-05-12 | ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navig | |
CVE-2026-57751 |
high | 8.1 | 0.0019 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions. | |
CVE-2026-12740 |
high | 8.1 | 0.0023 | 2026-07-04 | Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter | |
CVE-2026-12746 |
high | 8.1 | 0.0025 | 2026-07-04 | Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 st | |
CVE-2026-65757 |
high | 8.1 | 0.0019 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules An | |
CVE-2026-107618 |
high | 8.1 | 0.0016 | 2026-10-18 | `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross- | |
CVE-2026-61671 |
high | 8.1 | — | 2026-10-29 | WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3 | |
CVE-2026-46787 |
high | 8.0 | 0.0016 | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-46894 |
high | 8.0 | 0.0017 | 2026-06-17 | Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Pag | |
CVE-2026-34171 |
high | 8.0 | 0.0020 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-60643 |
high | 8.0 | 0.0020 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60646 |
high | 8.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-60648 |
high | 8.0 | 0.0018 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-60650 |
high | 8.0 | 0.0019 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-63265 |
high | 8.0 | 0.0018 | 2026-07-22 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Re | |
CVE-2026-35266 |
high | 7.9 | 0.0011 | 2026-05-28 | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected | |
CVE-2026-60642 |
high | 7.6 | 0.0015 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-60886 |
high | 7.6 | 0.0015 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal | |
CVE-2026-61132 |
high | 7.6 | 0.0015 | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Applicat | |
CVE-2026-34896 |
high | 7.5 | 0.0012 | 2026-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maint | |
CVE-2026-34904 |
high | 7.5 | 0.0012 | 2026-04-07 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allow |