Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-90861 |
medium | 6.6 | — | 2026-10-29 | Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user | |
CVE-2026-62839 |
medium | 6.5 | 0.0091 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to | |
CVE-2026-47282 |
medium | 6.5 | 0.0087 | 2026-07-14 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized | |
CVE-2026-22574 |
medium | 6.5 | 0.0027 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7 | |
CVE-2026-22576 |
medium | 6.5 | 0.0026 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7 | |
CVE-2026-28909 |
medium | 6.5 | 0.0020 | 2026-04-30 | Users who connect to malicious registries with hostnames matching the bypass patterns will have thei | |
CVE-2026-42367 |
medium | 6.5 | 0.0028 | 2026-05-04 | A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVisio | |
CVE-2026-8368 |
medium | 6.5 | 0.0027 | 2026-05-12 | LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on c | |
CVE-2026-14019 |
medium | 6.5 | 0.0031 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote a | |
CVE-2026-48022 |
medium | 6.5 | 0.0018 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Au | |
CVE-2026-15657 |
medium | 6.5 | 0.0034 | 2026-07-30 | A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext paym | |
CVE-2026-53586 |
medium | 6.5 | 0.0028 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a | |
CVE-2026-104314 |
medium | 6.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share gra | |
CVE-2026-110192 |
medium | 6.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitiv | |
CVE-2026-54276 |
medium | 6.3 | 0.0031 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, Dig | |
CVE-2026-44979 |
medium | 6.3 | 0.0042 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a | |
CVE-2026-71577 |
medium | 6.3 | 0.0042 | 2026-08-10 | A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectl | |
CVE-2026-115750 |
medium | 6.3 | 0.0022 | 2026-10-23 | mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows at | |
CVE-2026-49949 |
medium | 6.0 | 0.0025 | 2026-06-11 | CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent a | |
CVE-2026-62213 |
medium | 6.0 | 0.0036 | 2026-07-17 | OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound reques | |
CVE-2026-62214 |
medium | 6.0 | 0.0044 | 2026-07-17 | OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability | |
CVE-2026-15806 |
medium | 6.0 | 0.0053 | 2026-08-18 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWit | |
CVE-2026-113440 |
medium | 6.0 | 0.0031 | 2026-10-26 | Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirectin | |
CVE-2026-91766 |
medium | 5.9 | 0.0029 | 2026-09-25 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cook | |
CVE-2026-114221 |
medium | 5.9 | 0.0033 | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated | |
CVE-2026-53456 |
medium | 5.6 | 0.0021 | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5. | |
CVE-2026-32315 |
medium | 5.5 | 0.0168 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, a video surveillance program with motio | |
CVE-2026-54422 |
medium | 5.5 | 0.0015 | 2026-07-24 | In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ir | |
CVE-2026-21766 |
medium | 5.4 | 0.0029 | 2026-08-05 | The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently pr | |
CVE-2026-87097 |
medium | 5.3 | 0.0022 | 2026-10-28 | Sensitive information disclosure due to insufficiently protected credentials. The following products | |
CVE-2026-56570 |
medium | 5.3 | 0.0030 | 2026-07-31 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive inf | |
CVE-2026-1433 |
medium | 4.8 | 0.0031 | 2026-07-06 | uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability th | |
CVE-2026-28961 |
medium | 4.6 | 0.0024 | 2026-05-11 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS So | |
CVE-2026-62882 |
medium | 4.3 | 0.0067 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to | |
CVE-2026-34262 |
medium | 4.3 | 0.0030 | 2026-04-14 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer | |
CVE-2026-17569 |
medium | 4.3 | 0.0027 | 2026-07-27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated use | |
CVE-2026-21811 |
low | 3.8 | 0.0018 | 2026-10-22 | HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability i | |
CVE-2026-27316 |
low | 2.7 | 0.0031 | 2026-04-14 | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, F | |
CVE-2026-6408 |
low | 2.7 | 0.0018 | 2026-04-22 | Tanium addressed an information disclosure vulnerability in Tanium Server. | |
CVE-2026-7038 |
low | 1.9 | 0.0014 | 2026-04-26 | A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of | |
CVE-2026-0289 |
low | 0.5 | 0.0031 | 2026-08-13 | A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Bro | |
CVE-2026-0290 |
low | 0.5 | 0.0015 | 2026-08-13 | An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Pri | |
CVE-2021-30116 |
— | — | 0.8573 | — | Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability al | KEV |