Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2024-34324 |
critical | 9.1 | 0.0030 | 2026-10-13 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking atta | |
CVE-2026-40010 |
critical | 9.1 | 0.0038 | 2026-05-06 | Missing invocation of Servlet http web request method changeSessionId after session binding can be e | |
CVE-2026-93909 |
critical | 9.1 | 0.0034 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentica | |
CVE-2026-16496 |
high | 8.9 | 0.0036 | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the stream | |
CVE-2026-31940 |
high | 8.8 | 0.0024 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, in main/lp/aicc_hacp.p | |
CVE-2026-41613 |
high | 8.8 | 0.0052 | 2026-05-12 | Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a | |
CVE-2026-63161 |
high | 8.6 | 0.0038 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote | |
CVE-2026-33946 |
high | 8.2 | 0.0047 | 2026-03-27 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to versi | |
CVE-2026-12581 |
high | 7.7 | 0.0045 | 2026-06-22 | EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote a | |
CVE-2026-115910 |
medium | 6.8 | 0.0016 | 2026-10-26 | Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConn | |
CVE-2026-70594 |
medium | 6.7 | 0.0024 | 2026-08-04 | Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidat | |
CVE-2025-65415 |
medium | 5.4 | 0.0022 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to a session fixation attack via the logi | |
CVE-2026-45773 |
medium | 5.1 | 0.0012 | 2026-05-15 | Turborepo is a high-performance build system for JavaScript and TypeScript codebases. Prior to 2.9.1 | |
CVE-2026-35095 |
medium | 4.8 | 0.0021 | 2026-06-30 | KTM System e-BOK allows the session identifier to be set by the client prior to authentication. If a | |
CVE-2026-53900 |
medium | 4.3 | 0.0010 | 2026-06-16 | Firefox for iOS preserved cookies set on the initial PDF request across cross-origin HTTP redirects | |
CVE-2026-14609 |
low | 2.9 | 0.0040 | 2026-07-03 | A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analy | |
CVE-2026-11335 |
low | 2.1 | 0.0023 | 2026-06-05 | A flaw has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9 | |
CVE-2026-13707 |
none | — | 0.0034 | 2026-07-01 | Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated wit | |
CVE-2026-102489 |
— | — | 0.0196 | — | Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution | KEV |