Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1297)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (407)
CWE-77 (373)
CWE-190 (368)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-56124 |
high | 8.7 | 0.0064 | 2026-06-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allow | |
CVE-2026-62328 |
high | 8.7 | 0.0046 | 2026-07-13 | 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that | |
CVE-2026-57960 |
high | 8.3 | 0.0042 | 2026-06-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing | |
CVE-2026-28906 |
high | 7.5 | 0.0043 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iP | |
CVE-2026-48615 |
high | 7.5 | 0.0040 | 2026-06-26 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` e | |
CVE-2026-48048 |
high | 7.5 | 0.0201 | 2026-08-10 | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm w | |
CVE-2026-56171 |
high | 7.1 | 0.0066 | 2026-07-17 | Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthori | |
CVE-2026-58296 |
high | 7.1 | 0.0054 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allo | |
CVE-2026-58297 |
high | 7.1 | 0.0054 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allo | |
CVE-2026-49344 |
high | 7.1 | 0.0038 | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to | |
CVE-2026-7382 |
medium | 6.5 | 0.0034 | 2026-04-30 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information | |
CVE-2026-24078 |
medium | 6.5 | 0.0017 | 2026-08-04 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall S | |
CVE-2026-85916 |
medium | 6.2 | 0.0043 | 2026-10-13 | Exposure of private personal information to an unauthorized actor in Azure Active Directory allows a | |
CVE-2026-28950 |
medium | 6.2 | 0.0288 | 2026-04-22 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iP | |
CVE-2026-6765 |
medium | 5.3 | 0.0022 | 2026-04-21 | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, | |
CVE-2026-41182 |
medium | 5.3 | 0.0021 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0. | |
CVE-2026-8990 |
medium | 5.3 | 0.0021 | 2026-05-28 | A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile a | |
CVE-2026-50657 |
medium | 4.7 | 0.0040 | 2026-07-14 | Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an au | 1 PoC |
CVE-2026-28963 |
medium | 4.6 | 0.0016 | 2026-05-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and i | |
CVE-2026-34226 |
— | — | 0.0047 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Vers | |
CVE-2026-84606 |
— | — | 0.0041 | 2026-09-14 | A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 a | |
CVE-2026-86904 |
— | — | 0.0043 | 2026-09-14 | A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iP |