Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-68923 |
medium | 6.5 | 0.0026 | 2026-08-18 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py pl | |
CVE-2026-63123 |
medium | 6.5 | 0.0026 | 2026-08-19 | Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev ser | |
CVE-2026-111401 |
medium | 6.5 | 0.0015 | 2026-10-21 | Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allo | |
CVE-2026-61217 |
medium | 6.4 | 0.0014 | 2026-07-21 | Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle | |
CVE-2026-31014 |
medium | 6.3 | 0.0010 | 2026-04-21 | Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF). The | |
CVE-2026-40883 |
medium | 6.1 | 0.0014 | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross | |
CVE-2026-60685 |
medium | 6.1 | 0.0013 | 2026-07-21 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati | |
CVE-2026-60842 |
medium | 6.1 | 0.0013 | 2026-07-21 | Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Sear | |
CVE-2026-62487 |
medium | 6.1 | 0.0013 | 2026-07-21 | Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Int | |
CVE-2026-44613 |
medium | 6.1 | 0.0039 | 2026-07-30 | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration a | |
CVE-2026-91555 |
medium | 6.1 | 0.0013 | 2026-10-20 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Suppo | |
CVE-2026-91246 |
medium | 6.1 | 0.0024 | 2026-10-20 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime | |
CVE-2026-58482 |
medium | 5.9 | 0.0020 | 2026-07-20 | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented featu | |
CVE-2026-34749 |
medium | 5.4 | 0.0013 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cro | |
CVE-2026-39848 |
medium | 5.4 | 0.0011 | 2026-04-09 | Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop opera | |
CVE-2026-40948 |
medium | 5.4 | 0.0040 | 2026-04-18 | The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or valid | |
CVE-2026-40928 |
medium | 5.4 | 0.0011 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpo | |
CVE-2026-40929 |
medium | 5.4 | 0.0011 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.jso | |
CVE-2026-43877 |
medium | 5.4 | 0.0014 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/userSave | |
CVE-2026-0502 |
medium | 5.4 | 0.0012 | 2026-05-12 | Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authen | |
CVE-2026-57292 |
medium | 5.4 | 0.0014 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and | |
CVE-2026-57295 |
medium | 5.4 | 0.0022 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81 | |
CVE-2026-57298 |
medium | 5.4 | 0.0014 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Contrast Continuous Application Securit | |
CVE-2026-57305 |
medium | 5.4 | 0.0022 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows | |
CVE-2026-50743 |
medium | 5.4 | 0.0014 | 2026-07-20 | A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and u | |
CVE-2026-60911 |
medium | 5.4 | 0.0012 | 2026-07-21 | Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal | |
CVE-2026-60957 |
medium | 5.4 | 0.0012 | 2026-07-21 | Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: | |
CVE-2026-60962 |
medium | 5.4 | 0.0012 | 2026-07-21 | Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Intern | |
CVE-2026-61253 |
medium | 5.4 | 0.0013 | 2026-07-21 | Vulnerability in the Oracle HRMS (Japanese) product of Oracle E-Business Suite (component: Oracle Pa | |
CVE-2026-62563 |
medium | 5.4 | 0.0012 | 2026-07-21 | Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal | |
CVE-2026-64871 |
medium | 5.4 | 0.0013 | 2026-07-23 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Clea | |
CVE-2026-61981 |
medium | 5.4 | 0.0014 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions. | |
CVE-2026-65464 |
medium | 5.4 | 0.0014 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions. | |
CVE-2026-65512 |
medium | 5.4 | 0.0014 | 2026-07-23 | Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activi | |
CVE-2026-71123 |
medium | 5.4 | 0.0013 | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec | |
CVE-2026-96388 |
medium | 5.4 | 0.0012 | 2026-10-22 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cro | |
CVE-2026-115299 |
medium | 5.4 | 0.0010 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before sa | |
CVE-2026-40509 |
medium | 5.3 | 0.0019 | 2026-08-19 | OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The we | |
CVE-2026-114093 |
medium | 5.3 | 0.0019 | 2026-10-21 | Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote atta | |
CVE-2026-102787 |
medium | 5.3 | 0.0016 | 2026-10-27 | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | |
CVE-2026-118266 |
medium | 5.3 | 0.0016 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a sa | |
CVE-2026-40041 |
medium | 5.3 | 0.0011 | 2026-04-13 | Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform ar | |
CVE-2026-6777 |
medium | 5.3 | 0.0016 | 2026-04-21 | Other issue in the Networking: DNS component. This vulnerability was fixed in Firefox 150 and Thunde | |
CVE-2026-42190 |
medium | 5.3 | 0.0011 | 2026-05-08 | RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, se | |
CVE-2026-40703 |
medium | 5.3 | 0.0010 | 2026-05-13 | A cross-site request forgery (CSRF) vulnerability exists in the dashboard of the BIG-IP Configuratio | |
CVE-2026-49001 |
medium | 5.3 | 0.0011 | 2026-05-27 | Cross-site request forgery (CSRF) vulnerabilities allow attackers to exploit a user's authenticated | |
CVE-2026-44342 |
medium | 5.3 | 0.0019 | 2026-07-09 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys | |
CVE-2026-64821 |
medium | 5.3 | 0.0022 | 2026-07-21 | djangoSIGE through 1.10 (commit a6fe7e8) contains a cross-site request forgery vulnerability that al | |
CVE-2026-73162 |
medium | 5.3 | 0.0025 | 2026-08-11 | Affected versions of MISP cti-transmute expose several state-changing account operations as GET requ | |
CVE-2026-75151 |
medium | 5.3 | 0.0022 | 2026-08-18 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. |