Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-43992 |
critical | 9.8 | 0.0022 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write | |
CVE-2026-22098 |
critical | 9.2 | 0.0043 | 2026-07-13 | Various sensitive information such as passwords and charging card UIDs are written to log files. | |
CVE-2026-28923 |
high | 8.8 | 0.0015 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15. | |
CVE-2026-0207 |
high | 8.5 | 0.0038 | 2026-04-14 | A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific cond | |
CVE-2026-18710 |
high | 8.2 | 0.0014 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential u | |
CVE-2026-54652 |
high | 8.1 | 0.0029 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} end | |
CVE-2026-117341 |
high | 7.7 | 0.0023 | 2026-10-27 | In affected versions of Octopus Server, creating a user invitation writes the invitation code to the | |
CVE-2026-71845 |
high | 7.7 | 0.0050 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment v | |
CVE-2026-44516 |
high | 7.6 | 0.0020 | 2026-05-14 | Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, | |
CVE-2026-34487 |
high | 7.5 | 0.0045 | 2026-04-09 | Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clusterin | |
CVE-2026-31987 |
high | 7.5 | 0.0074 | 2026-04-16 | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Use | |
CVE-2025-67223 |
high | 7.5 | 0.0063 | 2026-04-28 | The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores d | |
CVE-2026-28943 |
high | 7.5 | 0.0044 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iP | |
CVE-2026-28987 |
high | 7.5 | 0.0044 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iP | |
CVE-2026-14528 |
high | 7.5 | 0.0045 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain se | |
CVE-2026-12947 |
high | 7.5 | 0.0040 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potenti | |
CVE-2026-32996 |
high | 7.3 | 0.0017 | 2026-05-28 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | |
CVE-2026-20205 |
high | 7.2 | 0.0028 | 2026-04-15 | In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_ | |
CVE-2026-116814 |
high | 7.1 | 0.0028 | 2026-10-27 | OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connectio | |
CVE-2026-41219 |
high | 7.1 | 0.0028 | 2026-05-13 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privile | |
CVE-2026-85171 |
high | 7.1 | 0.0056 | 2026-09-03 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, | |
CVE-2026-4901 |
medium | 6.9 | 0.0026 | 2026-04-09 | AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged a | |
CVE-2026-96293 |
medium | 6.9 | 0.0006 | 2026-10-22 | A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Di | |
CVE-2026-114073 |
medium | 6.8 | 0.0023 | 2026-10-21 | Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved | |
CVE-2026-19502 |
medium | 6.8 | 0.0018 | 2026-08-12 | MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file l | |
CVE-2026-108325 |
medium | 6.6 | 0.0024 | 2026-10-27 | Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation. | |
CVE-2026-90861 |
medium | 6.6 | — | 2026-10-29 | Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows may expose a user | |
CVE-2026-116691 |
medium | 6.5 | 0.0021 | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and machine lear | |
CVE-2026-41018 |
medium | 6.5 | 0.0041 | 2026-05-11 | The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for e | |
CVE-2026-43826 |
medium | 6.5 | 0.0041 | 2026-05-11 | The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for exam | |
CVE-2026-54704 |
medium | 6.5 | 0.0038 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation l | |
CVE-2026-46514 |
medium | 6.5 | 0.0045 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in | |
CVE-2026-20289 |
medium | 6.5 | 0.0033 | 2026-08-05 | A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacke | |
CVE-2026-65945 |
medium | 6.5 | 0.0064 | 2026-08-10 | Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgra | |
CVE-2026-68969 |
medium | 6.5 | 0.0036 | 2026-08-12 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext w | |
CVE-2026-75057 |
medium | 6.2 | 0.0017 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log | |
CVE-2026-79656 |
medium | 6.0 | 0.0016 | 2026-10-28 | A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover | |
CVE-2026-41184 |
medium | 6.0 | 0.0050 | 2026-05-28 | In Calico, the install-cni init container logs the rendered CNI configuration to standard output. Wh | |
CVE-2026-7824 |
medium | 5.9 | 0.0024 | 2026-05-05 | An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (di | |
CVE-2026-46467 |
medium | 5.8 | 0.0011 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-111762 |
medium | 5.7 | 0.0017 | 2026-10-20 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, Rest | |
CVE-2026-114409 |
medium | 5.7 | 0.0011 | 2026-10-27 | Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cle | |
CVE-2026-23775 |
medium | 5.7 | 0.0033 | 2026-04-17 | Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Releas | |
CVE-2026-15737 |
medium | 5.7 | 0.0038 | 2026-07-16 | AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for bui | |
CVE-2026-64800 |
medium | 5.7 | 0.0085 | 2026-07-23 | In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default | |
CVE-2023-21435 |
medium | 5.5 | 0.0018 | 2023-02-09 | Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 al | |
CVE-2026-50316 |
medium | 5.5 | 0.0048 | 2026-07-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to | |
CVE-2026-85857 |
medium | 5.5 | 0.0047 | 2026-10-13 | Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized | |
CVE-2026-27315 |
medium | 5.5 | 0.0016 | 2026-04-07 | Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, | |
CVE-2026-32215 |
medium | 5.5 | 0.0042 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to |