Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-32824 |
high | 7.3 | 0.0034 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-60945 |
high | 7.3 | 0.0033 | 2026-07-21 | Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Inter | |
CVE-2026-45037 |
high | 7.1 | 0.0014 | 2026-05-15 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.232, Tabby's term | |
CVE-2026-48856 |
high | 7.1 | 0.0034 | 2026-06-10 | Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Em | |
CVE-2026-47015 |
high | 7.1 | 0.0024 | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA | |
CVE-2026-69087 |
high | 7.1 | 0.0037 | 2026-08-03 | The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerabilit | |
CVE-2026-40037 |
high | 7.1 | 0.0031 | 2026-04-08 | OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that all | |
CVE-2026-44503 |
high | 7.0 | 0.0064 | 2026-05-14 | The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okH | |
CVE-2026-58230 |
high | 7.0 | 0.0031 | 2026-08-11 | SAP Approuter does not sufficiently validate certain token content under specific configurations. An | |
CVE-2026-40299 |
medium | 6.9 | 0.0034 | 2026-04-17 | next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware p | |
CVE-2026-44437 |
medium | 6.9 | 0.0020 | 2026-05-13 | The Angular SSR is a server-rise rendering tool for Angular applications. From 19.0.0-next.0 to befo | |
CVE-2026-58520 |
medium | 6.9 | 0.0028 | 2026-07-01 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediaw | |
CVE-2026-53668 |
medium | 6.9 | 0.0034 | 2026-07-27 | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, appl | |
CVE-2026-46688 |
medium | 6.9 | 0.0042 | 2026-08-13 | The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior t | |
CVE-2026-53523 |
medium | 6.8 | 0.0029 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-12379 |
medium | 6.8 | 0.0021 | 2026-07-16 | An Open Redirect vulnerability (CWE-601) exists in the OAuth/OIDC authentication implementation of t | |
CVE-2026-47045 |
medium | 6.8 | 0.0040 | 2026-07-21 | Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected | |
CVE-2026-118425 |
medium | 6.8 | — | 2026-10-29 | A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and acc | |
CVE-2026-103576 |
medium | 6.5 | 0.0086 | 2026-10-13 | Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) | |
CVE-2026-91318 |
medium | 6.5 | 0.0033 | 2026-10-20 | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Fram | |
CVE-2026-34315 |
medium | 6.5 | 0.0025 | 2026-04-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Serv | |
CVE-2026-61082 |
medium | 6.5 | 0.0019 | 2026-07-21 | Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported v | |
CVE-2026-53586 |
medium | 6.5 | 0.0028 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a | |
CVE-2026-15412 |
medium | 6.5 | 0.0034 | 2026-09-14 | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0. | |
CVE-2026-87937 |
medium | 6.5 | 0.0028 | 2026-10-22 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication S | |
CVE-2026-61143 |
medium | 6.4 | 0.0031 | 2026-07-21 | Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communic | |
CVE-2026-54276 |
medium | 6.3 | 0.0031 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, Dig | |
CVE-2026-83500 |
medium | 6.1 | 0.0045 | 2026-10-13 | Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized atta | |
CVE-2026-118656 |
medium | 6.1 | 0.0020 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes o | |
CVE-2026-33885 |
medium | 6.1 | 0.0018 | 2026-03-27 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and | |
CVE-2025-61166 |
medium | 6.1 | 0.0018 | 2026-04-06 | An open redirect in Ascertia SigningHub User v10.0 allows attackers to redirect users to a malicious | |
CVE-2026-39985 |
medium | 6.1 | 0.0020 | 2026-04-09 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provid | |
CVE-2026-25854 |
medium | 6.1 | 0.0053 | 2026-04-09 | Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via th | |
CVE-2026-32932 |
medium | 6.1 | 0.0018 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Open Redirect vulne | |
CVE-2026-34257 |
medium | 6.1 | 0.0015 | 2026-04-14 | Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated a | |
CVE-2026-40255 |
medium | 6.1 | 0.0025 | 2026-04-16 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In @adonisjs | |
CVE-2026-34283 |
medium | 6.1 | 0.0018 | 2026-04-21 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identit | |
CVE-2026-34284 |
medium | 6.1 | 0.0018 | 2026-04-21 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (c | |
CVE-2026-42207 |
medium | 6.1 | 0.0018 | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-45307 |
medium | 6.1 | 0.0018 | 2026-05-28 | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior | |
CVE-2026-46616 |
medium | 6.1 | 0.0018 | 2026-06-10 | Umbraco is an ASP.NET CMS. Prior to versions 13.14.0 and 17.4.0, some of the Surface Controllers in | |
CVE-2026-50089 |
medium | 6.1 | 0.0020 | 2026-06-12 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) provides an open redirect, which is an instance of | |
CVE-2026-44889 |
medium | 6.1 | 0.0027 | 2026-06-22 | WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HT | |
CVE-2026-25779 |
medium | 6.1 | 0.0030 | 2026-07-03 | Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded bac | |
CVE-2026-55461 |
medium | 6.1 | 0.0031 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()-> | |
CVE-2026-14902 |
medium | 6.1 | 0.0071 | 2026-07-14 | An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacke | |
CVE-2026-33213 |
medium | 6.1 | 0.0031 | 2026-07-15 | Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() fu | |
CVE-2026-61901 |
medium | 6.1 | 0.0024 | 2026-07-20 | Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop | |
CVE-2026-8284 |
medium | 6.1 | 0.0024 | 2026-07-21 | URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCit | |
CVE-2026-47002 |
medium | 6.1 | 0.0024 | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c |