Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-46955 |
high | 7.5 | 0.0016 | 2026-06-17 | Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). | |
CVE-2026-60658 |
high | 7.5 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten | |
CVE-2026-57723 |
high | 7.4 | 0.0017 | 2026-07-01 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS al | |
CVE-2026-12986 |
high | 7.3 | 0.0027 | 2026-06-24 | A critical vulnerability in Admin GUI in Payara Server Full 4.x, 5.x, 6.x, 7.x, 7.2026.x, 6.2025.x, | |
CVE-2026-65947 |
high | 7.3 | 0.0019 | 2026-07-29 | Joomla Extension - balbooa.com - Various CSRF vectors in the admin interface in Gridbox < 2.20.2 | |
CVE-2026-19418 |
high | 7.3 | 0.0024 | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective | |
CVE-2026-116204 |
high | 7.2 | 0.0014 | 2026-10-25 | YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools | |
CVE-2026-93631 |
high | 7.1 | 0.0018 | 2026-10-23 | A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS | |
CVE-2026-116839 |
high | 7.1 | 0.0010 | 2026-10-27 | A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Req | |
CVE-2026-116880 |
high | 7.1 | 0.0010 | 2026-10-27 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Sp | |
CVE-2025-62005 |
high | 7.1 | 0.0014 | 2025-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce | |
CVE-2026-40926 |
high | 7.1 | 0.0017 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endp | |
CVE-2026-45430 |
high | 7.1 | 0.0015 | 2026-05-12 | The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state paramet | |
CVE-2026-49396 |
high | 7.1 | 0.0014 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-57757 |
high | 7.1 | 0.0016 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions. | |
CVE-2026-57758 |
high | 7.1 | 0.0013 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 ve | |
CVE-2026-57761 |
high | 7.1 | 0.0013 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions. | |
CVE-2026-61956 |
high | 7.1 | 0.0016 | 2026-07-13 | Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسل | |
CVE-2026-62443 |
high | 7.1 | 0.0017 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Int | |
CVE-2026-65539 |
high | 7.1 | 0.0013 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. | |
CVE-2026-65540 |
high | 7.1 | 0.0013 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 version | |
CVE-2026-28172 |
high | 7.1 | 0.0013 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions. | |
CVE-2026-116210 |
high | 7.1 | 0.0017 | 2026-10-26 | Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos a | |
CVE-2026-58476 |
high | 7.0 | 0.0027 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery v | |
CVE-2026-58518 |
medium | 6.9 | 0.0013 | 2026-07-01 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectMana | |
CVE-2026-47725 |
medium | 6.9 | 0.0019 | 2026-07-28 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v | |
CVE-2026-63654 |
medium | 6.9 | 0.0026 | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted fr | |
CVE-2026-66885 |
medium | 6.8 | 0.0024 | 2026-08-05 | Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authe | |
CVE-2026-41317 |
medium | 6.6 | 0.0016 | 2026-04-24 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace | |
CVE-2026-62322 |
medium | 6.5 | 0.0015 | 2026-10-15 | Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backe | |
CVE-2026-113485 |
medium | 6.5 | 0.0013 | 2026-10-28 | The Media Library Assistant WordPress plugin before 3.42 does not consistently validate its CSRF non | |
CVE-2026-113486 |
medium | 6.5 | 0.0013 | 2026-10-28 | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty T | |
CVE-2026-5283 |
medium | 6.5 | 0.0027 | 2026-04-01 | Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote atta | |
CVE-2026-6755 |
medium | 6.5 | 0.0025 | 2026-04-21 | Mitigation bypass in the DOM: postMessage component. This vulnerability was fixed in Firefox 150 and | |
CVE-2026-42091 |
medium | 6.5 | 0.0016 | 2026-05-04 | goshs is a SimpleHTTPServer written in Go. Prior to version 2.0.2, the PUT upload handler (httpserve | |
CVE-2026-44347 |
medium | 6.5 | 0.0013 | 2026-05-12 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flo | |
CVE-2026-46869 |
medium | 6.5 | 0.0018 | 2026-06-17 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Support | |
CVE-2026-56024 |
medium | 6.5 | 0.0018 | 2026-06-18 | Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request F | |
CVE-2026-57635 |
medium | 6.5 | 0.0017 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerc | |
CVE-2026-57641 |
medium | 6.5 | 0.0017 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-31016 |
medium | 6.5 | 0.0022 | 2026-06-29 | Cross Site Request Forgery vulnerability in Squidex.io Squidex CMS v.7.21.0 and before allows a remo | |
CVE-2026-13826 |
medium | 6.5 | 0.0025 | 2026-06-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed | |
CVE-2026-13887 |
medium | 6.5 | 0.0025 | 2026-06-30 | Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a rem | |
CVE-2026-14016 |
medium | 6.5 | 0.0025 | 2026-06-30 | Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-57747 |
medium | 6.5 | 0.0017 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions. | |
CVE-2026-35143 |
medium | 6.5 | 0.0016 | 2026-07-16 | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to | |
CVE-2026-61082 |
medium | 6.5 | 0.0019 | 2026-07-21 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported v | |
CVE-2026-65536 |
medium | 6.5 | 0.0017 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، | |
CVE-2026-17936 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-71273 |
medium | 6.5 | 0.0017 | 2026-08-05 | OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a |