Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-36669 |
critical | 9.8 | 0.0066 | 2026-07-17 | An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11. | |
CVE-2026-14175 |
critical | 9.8 | 0.0052 | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Cons | |
CVE-2026-67688 |
critical | 9.8 | 0.0077 | 2026-08-06 | ICS-Park Smart Park Management System v2.0 contains an unrestricted file upload vulnerability in the | |
CVE-2026-72592 |
critical | 9.8 | 0.0080 | 2026-08-10 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated | |
CVE-2026-49827 |
critical | 9.8 | 0.0086 | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1 | |
CVE-2026-67678 |
critical | 9.8 | 0.0077 | 2026-08-17 | File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute ar | |
CVE-2026-15748 |
critical | 9.8 | 0.0409 | 2026-08-18 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up | |
CVE-2026-73996 |
critical | 9.8 | 0.0052 | 2026-08-18 | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | |
CVE-2025-61165 |
critical | 9.8 | 0.0045 | 2026-08-26 | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI | |
CVE-2026-109219 |
critical | 9.8 | 0.0069 | 2026-10-16 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the | |
CVE-2026-115245 |
critical | 9.8 | 0.0020 | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, r | |
CVE-2026-28192 |
critical | 9.6 | 0.0043 | 2026-08-18 | Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions. | |
CVE-2026-54630 |
critical | 9.6 | 0.0023 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-60032 |
critical | 9.4 | 0.0041 | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joom | |
CVE-2026-63048 |
critical | 9.4 | 0.0038 | 2026-07-22 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK 1.0.0-3.1.2, 3.4.0-3.4.1 | |
CVE-2026-65885 |
critical | 9.4 | 0.0052 | 2026-07-29 | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - File uplo | |
CVE-2026-2334 |
critical | 9.4 | 0.0072 | 2026-08-20 | An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges | |
CVE-2026-48356 |
critical | 9.3 | 0.4458 | 2026-07-14 | Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability | KEV |
CVE-2026-35047 |
critical | 9.3 | 0.0055 | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability in the CK | |
CVE-2026-6885 |
critical | 9.3 | 0.0050 | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File U | |
CVE-2026-53787 |
critical | 9.3 | 0.0564 | 2026-06-12 | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary fil | |
CVE-2026-5482 |
critical | 9.3 | 0.0044 | 2026-06-15 | Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extensio | |
CVE-2026-54414 |
critical | 9.3 | 0.0066 | 2026-06-19 | FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/fo | |
CVE-2026-24727 |
critical | 9.3 | 0.0065 | 2026-07-24 | An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload functio | |
CVE-2026-70558 |
critical | 9.3 | 0.0082 | 2026-08-06 | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directl | |
CVE-2026-6257 |
critical | 9.2 | 0.0063 | 2026-04-20 | Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management func | |
CVE-2026-58480 |
critical | 9.2 | 0.0357 | 2026-07-08 | Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file | |
CVE-2026-35573 |
critical | 9.1 | 0.0076 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability | |
CVE-2026-40484 |
critical | 9.1 | 0.0087 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backu | |
CVE-2026-58409 |
critical | 9.1 | 0.0057 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated admin | |
CVE-2026-27064 |
critical | 9.1 | 0.0050 | 2026-07-23 | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. | |
CVE-2026-65461 |
critical | 9.1 | 0.0050 | 2026-07-23 | Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions. | |
CVE-2026-90866 |
critical | 9.1 | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 202 | |
CVE-2026-90864 |
critical | 9.1 | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 202 | |
CVE-2026-61645 |
critical | 9.1 | — | 2026-10-29 | Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbit | |
CVE-2026-40487 |
critical | 9.0 | 0.0022 | 2026-04-18 | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypa | |
CVE-2026-52705 |
critical | 9.0 | 0.0029 | 2026-06-17 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. | |
CVE-2026-57828 |
critical | 9.0 | 0.0054 | 2026-07-11 | Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The J | |
CVE-2026-73373 |
high | 8.9 | 0.0065 | 2026-08-18 | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - | |
CVE-2024-44598 |
high | 8.8 | 0.0039 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. | |
CVE-2026-83526 |
high | 8.8 | 0.0063 | 2026-10-10 | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, a | |
CVE-2026-4337 |
high | 8.8 | 0.0032 | 2026-10-27 | Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a un | |
CVE-2026-109384 |
high | 8.8 | 0.0073 | 2026-10-28 | The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to Arbitrary File Uplo | |
CVE-2026-2701 |
high | 8.8 | 0.5454 | 2026-04-02 | Authenticated user can upload a malicious file to the server and execute it, which leads to remote c | |
CVE-2026-35164 |
high | 8.8 | 0.0071 | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in | |
CVE-2026-32931 |
high | 8.8 | 0.0050 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an unrestricted file u | |
CVE-2026-33704 |
high | 8.8 | 0.0042 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including stu | |
CVE-2026-41269 |
high | 8.8 | 0.0047 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-6261 |
high | 8.8 | 0.0061 | 2026-05-05 | The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and includ | |
CVE-2026-53593 |
high | 8.8 | 0.0035 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version |