Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-53573 |
medium | 4.8 | 0.0065 | 2026-07-31 | GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2. | |
CVE-2026-66370 |
medium | 4.8 | 0.0040 | 2026-08-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene ht | |
CVE-2026-111031 |
medium | 4.7 | 0.0024 | 2026-10-28 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not validate a user-supplied URL before u | |
CVE-2026-118658 |
medium | 4.7 | 0.0019 | 2026-10-28 | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarde | |
CVE-2026-2475 |
medium | 4.7 | 0.0026 | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 | |
CVE-2026-20060 |
medium | 4.7 | 0.0020 | 2026-04-15 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unaut | |
CVE-2026-35253 |
medium | 4.7 | 0.0015 | 2026-05-06 | Vulnerability in the Oracle Macoron Tool product of Oracle Open Source Projects. The supported versi | |
CVE-2026-49059 |
medium | 4.7 | 0.0023 | 2026-05-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for WooCommer | |
CVE-2026-49820 |
medium | 4.7 | 0.0042 | 2026-08-13 | Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and s | |
CVE-2026-91526 |
medium | 4.7 | 0.0018 | 2026-10-20 | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Suppo | |
CVE-2026-42525 |
medium | 4.3 | 0.0021 | 2026-04-29 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restr | |
CVE-2026-42565 |
medium | 4.3 | 0.0019 | 2026-05-11 | @workos/authkit-session is a toolkit for building WorkOS AuthKit framework integrations. Prior to 0. | |
CVE-2026-45448 |
medium | 4.3 | 0.0017 | 2026-05-14 | CWE-601 URL redirection to untrusted site ('open redirect') | |
CVE-2026-53436 |
medium | 4.3 | 0.0028 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after l | |
CVE-2026-53440 |
medium | 4.3 | 0.0023 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the | |
CVE-2026-20178 |
medium | 4.3 | 0.0020 | 2026-06-17 | A vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticate | |
CVE-2026-15093 |
medium | 4.3 | 0.0037 | 2026-07-17 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to ma | |
CVE-2026-17912 |
medium | 4.3 | 0.0024 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowe | |
CVE-2026-71240 |
medium | 4.3 | 0.0033 | 2026-08-05 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in l | |
CVE-2026-59717 |
medium | 4.3 | 0.0038 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior t | |
CVE-2026-19078 |
medium | 4.3 | 0.0036 | 2026-08-11 | A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'th | |
CVE-2026-91428 |
medium | 4.3 | 0.0020 | 2026-10-20 | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Support | |
CVE-2026-55403 |
low | 3.7 | 0.0034 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/ | |
CVE-2026-114614 |
low | 3.5 | 0.0018 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, au | |
CVE-2026-42195 |
low | 3.4 | 0.0019 | 2026-05-08 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the dr | |
CVE-2026-59180 |
low | 3.1 | 0.0030 | 2026-07-10 | Apprise is an open source library which allows you to send a notification to almost all of the most | |
CVE-2026-66829 |
low | 2.3 | 0.0057 | 2026-08-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene ht | |
CVE-2026-44915 |
low | 2.1 | 0.0064 | 2026-06-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The default con | |
CVE-2026-48895 |
low | 2.1 | 0.0065 | 2026-06-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker co | |
CVE-2026-14632 |
low | 2.1 | 0.0046 | 2026-07-04 | A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8cebbb87ab46ae45 | |
CVE-2026-59730 |
low | 2.1 | 0.0046 | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 8.1.0 through 11.0.1, when trailin | |
CVE-2026-67350 |
low | 2.1 | 0.0035 | 2026-07-31 | Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthentic | |
CVE-2026-18721 |
low | 2.1 | 0.0043 | 2026-08-04 | A vulnerability has been found in kalcaddle kodbox 1.67 Build 02. This issue affects some unknown pr | |
CVE-2026-64941 |
low | 2.1 | 0.0060 | 2026-08-10 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_v | |
CVE-2026-112034 |
low | 2.1 | 0.0035 | 2026-10-19 | A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the fu | |
CVE-2026-113384 |
low | 2.1 | 0.0031 | 2026-10-20 | A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of th | |
CVE-2026-114060 |
low | 2.1 | 0.0020 | 2026-10-21 | SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form acti | |
CVE-2026-115537 |
low | 2.1 | 0.0032 | 2026-10-23 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d4 | |
CVE-2026-116578 |
low | 2.1 | 0.0046 | 2026-10-26 | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.Red | |
CVE-2026-44427 |
none | — | 0.0047 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. | |
CVE-2026-3872 |
— | — | 0.0044 | 2026-04-02 | A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same w | |
CVE-2026-39484 |
— | — | 0.0020 | 2026-04-08 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in John Darrel Hide My WP Ghost hi | |
CVE-2026-7504 |
— | — | 0.0050 | 2026-05-19 | A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malici | |
CVE-2026-53437 |
— | — | 0.0047 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after l | |
CVE-2012-0518 |
— | — | 0.0469 | — | Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion | KEV |