Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-114072 |
medium | 5.3 | 0.0012 | 2026-10-21 | The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its orga | |
CVE-2026-114470 |
medium | 5.3 | 0.0015 | 2026-10-21 | Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allo | |
CVE-2026-115494 |
medium | 5.3 | 0.0019 | 2026-10-22 | A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1. | |
CVE-2026-116072 |
medium | 5.3 | 0.0012 | 2026-10-25 | Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that all | |
CVE-2026-116052 |
medium | 5.3 | 0.0021 | 2026-10-25 | A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is a | |
CVE-2026-64962 |
medium | 5.1 | 0.0022 | 2026-08-20 | ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attack | |
CVE-2026-100749 |
medium | 5.1 | 0.0009 | 2026-09-27 | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5. | |
CVE-2026-114048 |
medium | 5.1 | 0.0016 | 2026-10-21 | WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like | |
CVE-2026-116895 |
medium | 5.1 | 0.0010 | 2026-10-27 | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend process | |
CVE-2026-117534 |
medium | 5.1 | 0.0010 | 2026-10-27 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history pl | |
CVE-2026-45773 |
medium | 5.1 | 0.0012 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.1 | |
CVE-2026-35096 |
medium | 5.1 | 0.0022 | 2026-06-30 | KTM System e-BOK is vulnerable to Cross‑Site Request Forgery (CSRF) in both the email-change and pas | |
CVE-2026-58315 |
medium | 5.1 | 0.0015 | 2026-07-07 | Cross-site request forgery vulnerability exists in SEIKO EPSON Web Config. If a user views a malicio | |
CVE-2026-61502 |
medium | 5.1 | 0.0022 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts G | |
CVE-2026-73423 |
medium | 5.1 | 0.0026 | 2026-08-12 | Astro is a web framework for content-driven websites. From 7.0.0 until 7.0.6, the composable astro/h | |
CVE-2026-77058 |
medium | 5.1 | 0.0026 | 2026-10-26 | boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints | |
CVE-2026-13243 |
medium | 4.8 | 0.0012 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Salesforce Suite allows Cross Site Request | |
CVE-2026-5702 |
medium | 4.8 | — | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can | |
CVE-2026-49043 |
medium | 4.7 | 0.0015 | 2026-06-15 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Migrate Lite <= 2.7.8 versions. | |
CVE-2026-77029 |
medium | 4.6 | 0.0021 | 2026-08-21 | Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66 | |
CVE-2023-3055 |
medium | 4.3 | 0.0021 | 2023-06-03 | The Page Builder by AZEXO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio | |
CVE-2025-26926 |
medium | 4.3 | 0.0016 | 2025-02-25 | Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic booknetic allows Cross Site R | |
CVE-2025-67591 |
medium | 4.3 | 0.0012 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross | |
CVE-2026-42645 |
medium | 4.3 | 0.0010 | 2026-04-29 | Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner | |
CVE-2026-27415 |
medium | 4.3 | 0.0009 | 2026-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows Cross Site Request Forge | |
CVE-2026-48518 |
medium | 4.3 | 0.0020 | 2026-06-15 | MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the | |
CVE-2026-57283 |
medium | 4.3 | 0.0024 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Plugin 4331.v9d06ed465 | |
CVE-2026-57290 |
medium | 4.3 | 0.0025 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Priority Sorter Plugin 936.v2c01c6b_844 | |
CVE-2026-57637 |
medium | 4.3 | 0.0014 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Abandoned Cart Lite for WooCommerce <= 6.8.0 ve | |
CVE-2026-57657 |
medium | 4.3 | 0.0014 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Gmail SMTP <= 1.2.3.19 versions. | |
CVE-2026-13946 |
medium | 4.3 | 0.0021 | 2026-06-30 | Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allo | |
CVE-2026-13952 |
medium | 4.3 | 0.0021 | 2026-06-30 | Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a re | |
CVE-2026-57690 |
medium | 4.3 | 0.0014 | 2026-07-02 | Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions. | |
CVE-2026-59520 |
medium | 4.3 | 0.0014 | 2026-07-05 | Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Requ | |
CVE-2026-15080 |
medium | 4.3 | 0.0014 | 2026-07-10 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Ray Enterprise Translation allows Cross Si | |
CVE-2026-32823 |
medium | 4.3 | 0.0014 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-24537 |
medium | 4.3 | 0.0014 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions | |
CVE-2026-65460 |
medium | 4.3 | 0.0014 | 2026-07-23 | Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions. | |
CVE-2026-66428 |
medium | 4.3 | 0.0014 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions. | |
CVE-2026-66474 |
medium | 4.3 | 0.0014 | 2026-07-27 | Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= | |
CVE-2026-66681 |
medium | 4.3 | 0.0014 | 2026-08-06 | Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions. | |
CVE-2026-66775 |
medium | 4.3 | 0.0016 | 2026-08-11 | SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by d | |
CVE-2026-97295 |
medium | 4.3 | 0.0012 | 2026-10-26 | Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-libra | |
CVE-2026-110983 |
medium | 4.3 | 0.0010 | 2026-10-29 | The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security | |
CVE-2026-115300 |
medium | 4.3 | 0.0010 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or requ | |
CVE-2026-27062 |
medium | 4.3 | — | 2026-10-29 | Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross S | |
CVE-2026-76297 |
medium | 4.2 | 0.0011 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user cou | |
CVE-2026-57306 |
medium | 4.2 | 0.0018 | 2026-06-24 | A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_4 | |
CVE-2026-70434 |
medium | 4.2 | 0.0011 | 2026-08-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier a | |
CVE-2026-113796 |
medium | 4.2 | 0.0022 | 2026-10-21 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C |