Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (837)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42869 |
critical | 10.0 | 0.0056 | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations nee | |
CVE-2026-84295 |
critical | 10.0 | — | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 o | |
CVE-2026-56843 |
critical | 9.9 | 0.0066 | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged | |
CVE-2026-52855 |
critical | 9.9 | 0.0051 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. | |
CVE-2026-43992 |
critical | 9.8 | 0.0022 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write | |
CVE-2026-59891 |
critical | 9.6 | 0.0047 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, ge | |
CVE-2025-6519 |
critical | 9.3 | 0.0054 | 2025-09-02 | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily gener | |
CVE-2026-39462 |
critical | 9.3 | 0.0039 | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface in which password updates are n | |
CVE-2026-62327 |
critical | 9.3 | 0.0627 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that | |
CVE-2026-67426 |
critical | 9.3 | 0.0037 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the stand | |
CVE-2026-17349 |
critical | 9.3 | 0.0040 | 2026-07-31 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, wh | |
CVE-2026-72793 |
critical | 9.2 | 0.0031 | 2026-08-12 | SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf | |
CVE-2026-72794 |
critical | 9.2 | 0.0032 | 2026-08-12 | siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf | |
CVE-2026-45091 |
critical | 9.1 | 0.0033 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. | |
CVE-2026-63160 |
critical | 9.1 | 0.0033 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me tok | |
CVE-2023-41677 |
high | 8.8 | 0.0075 | 2024-04-09 | A insufficiently protected credentials vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiO | |
CVE-2026-32171 |
high | 8.8 | 0.0044 | 2026-04-14 | Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate pr | |
CVE-2026-44938 |
high | 8.8 | 0.0044 | 2026-07-07 | A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-se | |
CVE-2026-103090 |
high | 8.8 | 0.0034 | 2026-10-21 | Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE | |
CVE-2026-104384 |
high | 8.7 | 0.0043 | 2026-10-28 | Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aqu | |
CVE-2026-57219 |
high | 8.7 | 0.0284 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsol | |
CVE-2026-14354 |
high | 8.7 | 0.0016 | 2026-07-29 | CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication by | |
CVE-2026-47660 |
high | 8.7 | 0.0054 | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health da | |
CVE-2026-47662 |
high | 8.7 | 0.0041 | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health da | |
CVE-2026-72801 |
high | 8.7 | 0.0031 | 2026-08-12 | SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data k | |
CVE-2026-67425 |
high | 8.6 | 0.0041 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat | |
CVE-2026-67427 |
high | 8.6 | 0.0045 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf | |
CVE-2026-96626 |
high | 8.5 | 0.0022 | 2026-10-16 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0 | |
CVE-2026-57485 |
high | 8.5 | 0.0042 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P | |
CVE-2026-55765 |
high | 8.5 | 0.0050 | 2026-08-20 | CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. | |
CVE-2026-59261 |
high | 8.4 | 0.0027 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files | |
CVE-2026-12984 |
high | 8.2 | 0.0034 | 2026-08-10 | Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedde | |
CVE-2026-88967 |
high | 7.7 | 0.0029 | 2026-10-28 | A user with query access to an Azure Monitor data source in Grafana can cause server-side requests t | |
CVE-2025-52545 |
high | 7.7 | 0.0026 | 2025-09-02 | E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read use | |
CVE-2026-41266 |
high | 7.7 | 0.0406 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-59158 |
high | 7.5 | 0.0050 | 2026-10-27 | Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1 | |
CVE-2026-111765 |
high | 7.5 | 0.0080 | 2026-10-20 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0. | |
CVE-2026-54660 |
high | 7.4 | 0.0031 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-118763 |
high | 7.4 | — | 2026-10-29 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, pa | |
CVE-2026-116683 |
high | 7.1 | 0.0038 | 2026-10-27 | CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team | |
CVE-2026-35155 |
high | 7.1 | 0.0022 | 2026-04-29 | Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials v | |
CVE-2026-56783 |
high | 7.1 | 0.0035 | 2026-06-29 | Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target A | |
CVE-2026-7017 |
high | 7.1 | 0.0035 | 2026-07-07 | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect target | |
CVE-2026-59209 |
high | 7.1 | 0.0040 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authe | |
CVE-2026-46458 |
high | 7.1 | 0.0036 | 2026-07-15 | ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential | |
CVE-2026-115371 |
high | 7.1 | 0.0022 | 2026-10-22 | Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorizat | |
CVE-2026-44622 |
medium | 6.9 | 0.0042 | 2026-06-25 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. | |
CVE-2026-53454 |
medium | 6.9 | 0.0046 | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5. | |
CVE-2026-101034 |
medium | 6.8 | 0.0015 | 2026-10-27 | An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run- | |
CVE-2026-55885 |
medium | 6.8 | 0.0022 | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permi |