Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65939 |
medium | 6.8 | 0.0038 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile acti | |
CVE-2026-24330 |
medium | 6.5 | 0.0052 | 2026-08-11 | A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can impo | |
CVE-2025-65416 |
medium | 6.3 | 0.0027 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php | |
CVE-2026-42879 |
medium | 6.3 | 0.0023 | 2026-05-27 | FacturaScripts is an open source accounting and invoicing software. In 2025.81 and earlier, an authe | |
CVE-2026-48946 |
medium | 6.3 | 0.0028 | 2026-06-25 | The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's | |
CVE-2026-0643 |
medium | 5.5 | 0.0042 | 2026-01-07 | A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown | |
CVE-2026-5261 |
medium | 5.5 | 0.0039 | 2026-04-01 | A vulnerability was identified in Shandong Hoteam InforCenter PLM up to 8.3.8. The impacted element | |
CVE-2026-5704 |
medium | 5.5 | 0.0043 | 2026-04-06 | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious | |
CVE-2026-6602 |
medium | 5.5 | 0.0038 | 2026-04-20 | A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad | |
CVE-2026-8758 |
medium | 5.5 | 0.0028 | 2026-05-17 | A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown | |
CVE-2026-11344 |
medium | 5.5 | 0.0037 | 2026-06-05 | A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown fu | |
CVE-2026-13547 |
medium | 5.5 | 0.0047 | 2026-06-29 | A vulnerability was determined in Hanwang e-Face General Management Platform 6.3.5.4. This issue aff | |
CVE-2026-13553 |
medium | 5.5 | 0.0050 | 2026-06-29 | A flaw has been found in itsourcecode Online Hotel Management System 1.0. Affected is an unknown fun | |
CVE-2026-14736 |
medium | 5.5 | 0.0047 | 2026-07-05 | A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown f | |
CVE-2026-15488 |
medium | 5.5 | 0.0050 | 2026-07-12 | A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileCon | |
CVE-2026-15677 |
medium | 5.5 | 0.0050 | 2026-07-14 | A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown funct | |
CVE-2026-16324 |
medium | 5.5 | 0.0047 | 2026-07-20 | A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is | |
CVE-2026-16327 |
medium | 5.5 | 0.0157 | 2026-07-21 | A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing o | |
CVE-2026-16329 |
medium | 5.5 | 0.0145 | 2026-07-21 | A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file | |
CVE-2026-16330 |
medium | 5.5 | 0.0157 | 2026-07-21 | A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function | |
CVE-2026-16331 |
medium | 5.5 | 0.0157 | 2026-07-21 | A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function | |
CVE-2026-16332 |
medium | 5.5 | 0.0145 | 2026-07-21 | A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file / | |
CVE-2026-16447 |
medium | 5.5 | 0.0157 | 2026-07-21 | A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file | |
CVE-2026-18788 |
medium | 5.5 | 0.0050 | 2026-08-04 | A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted eleme | |
CVE-2026-18969 |
medium | 5.5 | 0.0047 | 2026-08-06 | A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20 | |
CVE-2026-78202 |
medium | 5.5 | 0.0050 | 2026-08-24 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting | |
CVE-2026-39527 |
medium | 5.4 | 0.0029 | 2026-06-15 | Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions. | |
CVE-2026-53948 |
medium | 5.4 | 0.0023 | 2026-06-24 | Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, insufficient validation of t | |
CVE-2026-59188 |
medium | 5.4 | 0.0015 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-113472 |
medium | 5.4 | 0.0023 | 2026-10-23 | The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploa | |
CVE-2026-22707 |
medium | 5.3 | 0.0019 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the | |
CVE-2026-34027 |
medium | 5.3 | 0.0031 | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server- | |
CVE-2026-48945 |
medium | 5.3 | 0.0033 | 2026-06-25 | The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries | |
CVE-2026-53909 |
medium | 5.3 | 0.0039 | 2026-07-01 | MCO does not correctly validate types of uploaded files. File upload validation functionality relies | |
CVE-2026-14906 |
medium | 5.3 | 0.0029 | 2026-07-13 | Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bund | |
CVE-2026-61457 |
medium | 5.3 | 0.0061 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 contains a file upload extension bypass i | |
CVE-2026-57311 |
medium | 5.3 | 0.0063 | 2026-07-20 | Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary | |
CVE-2026-44097 |
medium | 5.3 | 0.0043 | 2026-07-30 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endp | |
CVE-2026-19065 |
medium | 5.3 | 0.0035 | 2026-08-06 | A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0 | |
CVE-2026-71434 |
medium | 5.3 | 0.0041 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, p | |
CVE-2026-116113 |
medium | 5.3 | 0.0020 | 2026-10-26 | A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chu | |
CVE-2026-114398 |
medium | 5.1 | 0.0018 | 2026-10-21 | Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authentica | |
CVE-2025-52546 |
medium | 5.1 | 0.0020 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an | |
CVE-2026-6835 |
medium | 5.1 | 0.0021 | 2026-04-22 | The a+HCM developed by aEnrich has an Arbitrary File Upload vulnerability, allowing unauthenticated | |
CVE-2026-16226 |
medium | 5.1 | 0.0038 | 2026-07-19 | A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This affects the func | |
CVE-2026-43752 |
medium | 4.9 | 0.0049 | 2026-07-09 | An authenticated administrator may be able to achieve arbitrary code execution on the host system by | |
CVE-2026-16889 |
medium | 4.8 | 0.0032 | 2026-10-29 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/im | |
CVE-2026-21662 |
medium | 4.8 | 0.0050 | 2026-07-31 | Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employe | |
CVE-2026-3219 |
medium | 4.6 | 0.0014 | 2026-04-20 | pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is | |
CVE-2026-42145 |
low | 3.1 | 0.0039 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. |