Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-14270 |
high | 8.8 | 0.0079 | 2026-07-29 | The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for Wo | |
CVE-2026-72557 |
high | 8.8 | 0.0048 | 2026-08-11 | An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload | |
CVE-2026-64960 |
high | 8.7 | 0.0063 | 2026-08-20 | ATutor Gameme module allows users to upload files of any type and extension without restriction. Due | |
CVE-2014-125138 |
high | 8.7 | 0.0042 | 2026-10-28 | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 cont | |
CVE-2026-40040 |
high | 8.7 | 0.0047 | 2026-04-13 | Pachno 1.0.6 contains an unrestricted file upload vulnerability that allows authenticated users to u | |
CVE-2026-40262 |
high | 8.7 | 0.0031 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset deliver | |
CVE-2026-40488 |
high | 8.7 | 0.0069 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-6249 |
high | 8.7 | 0.0062 | 2026-04-20 | Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that al | |
CVE-2026-41938 |
high | 8.7 | 0.0072 | 2026-05-06 | Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload | |
CVE-2026-42844 |
high | 8.7 | 0.0034 | 2026-05-12 | Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a low-privileged authenticated API user wit | |
CVE-2026-46392 |
high | 8.7 | 0.0027 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX | |
CVE-2026-6211 |
high | 8.7 | 0.0021 | 2026-06-12 | Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. | |
CVE-2026-23697 |
high | 8.7 | 0.0100 | 2026-07-07 | Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileg | |
CVE-2026-55676 |
high | 8.7 | 0.0060 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. The file-upload component (FilePond PHP backend) a | |
CVE-2026-68899 |
high | 8.7 | 0.0053 | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 9.90, isFileValid() in models/fileValidation | |
CVE-2024-58313 |
high | 8.6 | 0.0061 | 2025-12-11 | xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers wi | |
CVE-2026-117607 |
high | 8.6 | 0.0068 | 2026-10-28 | Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows auth | |
CVE-2026-67073 |
high | 8.6 | 0.0022 | 2026-10-28 | HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. | |
CVE-2026-7490 |
high | 8.6 | 0.0046 | 2026-05-02 | CTMS and CPAS developed by Sunnet has an Arbitrary File Upload vulnerability, allowing privileged re | |
CVE-2026-41587 |
high | 8.6 | 0.0062 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-41937 |
high | 8.6 | 0.0040 | 2026-05-14 | Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoin | |
CVE-2026-44088 |
high | 8.6 | 0.0044 | 2026-05-15 | SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading fro | |
CVE-2026-56414 |
high | 8.6 | 0.0039 | 2026-06-26 | A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticate | |
CVE-2026-13165 |
high | 8.6 | 0.0071 | 2026-06-29 | SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Centr | |
CVE-2026-53691 |
high | 8.6 | 0.0067 | 2026-06-30 | An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers | |
CVE-2026-23698 |
high | 8.6 | 0.0123 | 2026-07-07 | Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin | |
CVE-2026-61524 |
high | 8.6 | 0.0103 | 2026-08-03 | WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module ins | |
CVE-2026-67243 |
high | 8.6 | 0.0054 | 2026-08-04 | freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. | |
CVE-2026-104069 |
high | 8.6 | 0.0053 | 2026-10-06 | HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() wh | |
CVE-2026-116236 |
high | 8.6 | 0.0039 | 2026-10-26 | A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the functi | |
CVE-2025-34506 |
high | 8.6 | 0.0091 | 2025-12-11 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that | |
CVE-2026-32989 |
high | 8.6 | 0.0022 | 2026-03-20 | Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attacke | |
CVE-2026-65986 |
high | 8.5 | 0.0040 | 2026-08-04 | CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.5 | |
CVE-2026-115481 |
high | 8.5 | 0.0034 | 2026-10-23 | baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5 | |
CVE-2024-44599 |
high | 8.3 | 0.0047 | 2025-12-15 | FNT Command 13.4.0 is vulnerable to Directory Traversal. | |
CVE-2026-45089 |
high | 8.2 | 0.0024 | 2026-05-27 | Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, whe | |
CVE-2023-27753 |
high | 8.0 | 0.0033 | 2026-05-12 | An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary co | |
CVE-2026-33435 |
high | 8.0 | 0.0071 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filte | |
CVE-2026-39598 |
high | 8.0 | 0.0022 | 2026-06-17 | Unrestricted Upload of File with Dangerous Type vulnerability in Kodezen LLC Academy LMS Pro allows | |
CVE-2023-37208 |
high | 7.8 | 0.0023 | 2023-07-05 | When opening Diagcab files, Firefox did not warn the user that these files may contain malicious cod | |
CVE-2026-49972 |
high | 7.7 | 0.0108 | 2026-07-13 | Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attac | |
CVE-2026-72762 |
high | 7.7 | 0.0048 | 2026-08-11 | n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write vulnerability in th | |
CVE-2026-111255 |
high | 7.5 | 0.0052 | 2026-10-28 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vul | |
CVE-2026-53599 |
high | 7.5 | 0.0051 | 2026-07-31 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedE | |
CVE-2026-54416 |
high | 7.2 | 0.0050 | 2026-08-05 | Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using | |
CVE-2026-114259 |
medium | 6.9 | 0.0030 | 2026-10-21 | A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e959 | |
CVE-2026-114262 |
medium | 6.9 | 0.0037 | 2026-10-21 | A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. I | |
CVE-2026-117512 |
medium | 6.9 | 0.0037 | 2026-10-27 | A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the | |
CVE-2025-34336 |
medium | 6.9 | 0.0046 | 2025-11-19 | eGovFramework/egovframe-common-components versions up to and including 4.3.1 contain an unauthentica | |
CVE-2026-15553 |
medium | 6.9 | 0.0041 | 2026-07-13 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing una |