Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-46455 |
critical | 9.8 | 0.0069 | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloa | |
CVE-2026-28564 |
critical | 9.8 | 0.0068 | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoT | |
CVE-2026-15967 |
critical | 9.8 | 0.0037 | 2026-07-23 | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEi | |
CVE-2026-53776 |
critical | 9.3 | 0.0036 | 2026-06-16 | Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass | |
CVE-2026-89035 |
critical | 9.1 | 0.0027 | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interfa | |
CVE-2026-64829 |
critical | 9.1 | 0.0042 | 2026-07-22 | Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows attackers wi | |
CVE-2026-60053 |
critical | 9.1 | 0.0057 | 2026-08-05 | Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: t | |
CVE-2026-34570 |
high | 8.8 | 0.0051 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-34572 |
high | 8.8 | 0.0051 | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w | |
CVE-2026-44383 |
high | 8.7 | 0.0056 | 2026-07-10 | Multiple connections to the backend using the same charging station ID are allowed, which could all | |
CVE-2026-17600 |
high | 8.7 | 0.0044 | 2026-08-07 | Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke th | |
CVE-2026-104084 |
high | 8.7 | 0.0031 | 2026-10-09 | SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and ref | |
CVE-2026-74037 |
high | 8.6 | 0.0049 | 2026-10-13 | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, | |
CVE-2025-65883 |
high | 8.4 | 0.0038 | 2025-12-04 | A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that a | |
CVE-2026-49229 |
high | 8.3 | 0.0032 | 2026-07-07 | Actual is a local-first personal finance app. Prior to 26.6.0, in OpenID multi-user mode, disabling | |
CVE-2026-71206 |
high | 8.3 | 0.0037 | 2026-08-05 | Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and | |
CVE-2026-96616 |
high | 8.3 | 0.0037 | 2026-10-22 | Authentication tokens issued by the E3's web management interface on login are given an expiration t | |
CVE-2026-118665 |
high | 8.2 | 0.0039 | 2026-10-28 | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to vers | |
CVE-2026-14996 |
high | 8.2 | 0.0034 | 2026-07-28 | IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session manageme | |
CVE-2026-6848 |
high | 8.1 | 0.0027 | 2026-04-22 | A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive | |
CVE-2026-43911 |
high | 8.1 | 0.0022 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are no | |
CVE-2026-39924 |
high | 7.6 | 0.0037 | 2026-08-05 | Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers w | |
CVE-2026-65984 |
high | 7.5 | 0.0052 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST | |
CVE-2026-6647 |
high | 7.4 | 0.0021 | 2026-10-28 | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sens | |
CVE-2026-44511 |
high | 7.4 | 0.0020 | 2026-05-14 | Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin | |
CVE-2026-48079 |
high | 7.4 | 0.0050 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-114137 |
high | 7.4 | 0.0047 | 2026-10-21 | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delet | |
CVE-2026-63175 |
high | 7.1 | 0.0047 | 2026-07-15 | PlaywrightCapture stored capture-specific configuration and runtime data as mutable class-level vari | |
CVE-2026-54321 |
high | 7.0 | 0.0040 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-25720 |
medium | 6.9 | 0.0028 | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifeti | |
CVE-2026-54479 |
medium | 6.9 | 0.0042 | 2026-06-25 | The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows mu | |
CVE-2026-61452 |
medium | 6.9 | 0.0024 | 2026-07-15 | The Grav API plugin (getgrav/grav-plugin-api) before 2.0.4 contains an improper session invalidation | |
CVE-2026-14227 |
medium | 6.9 | 0.0038 | 2026-07-30 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to | |
CVE-2026-40939 |
medium | 6.8 | 0.0015 | 2026-04-21 | The Data Sharing Framework (DSF) implements a distributed process engine based on the BPMN 2.0 and F | |
CVE-2026-9802 |
medium | 6.8 | 0.0030 | 2026-05-28 | A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage | |
CVE-2026-35594 |
medium | 6.5 | 0.0031 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share | |
CVE-2026-40587 |
medium | 6.5 | 0.0024 | 2026-04-21 | blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their pa | |
CVE-2026-14465 |
medium | 6.5 | 0.0035 | 2026-08-04 | Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUM | |
CVE-2025-36252 |
medium | 6.3 | 0.0020 | 2026-10-19 | IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library | |
CVE-2026-107146 |
medium | 6.3 | 0.0035 | 2026-10-27 | The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed | |
CVE-2026-66400 |
medium | 6.3 | 0.0024 | 2026-07-29 | Grav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in | |
CVE-2026-55423 |
medium | 6.1 | 0.0022 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the l | |
CVE-2026-26060 |
medium | 6.0 | 0.0035 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s passwor | |
CVE-2026-5376 |
medium | 5.9 | 0.0021 | 2026-04-07 | An issue that could prevent session inactivity timeouts from triggering due to automatic page reload | |
CVE-2025-36069 |
medium | 5.5 | 0.0015 | 2026-10-19 | IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which | |
CVE-2026-34362 |
medium | 5.4 | 0.0025 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyToken | |
CVE-2026-41519 |
medium | 5.4 | 0.0027 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, when a user changes their passwor | |
CVE-2026-44873 |
medium | 5.4 | 0.0014 | 2026-05-12 | A session management vulnerability in AOS-8 allows previously authenticated users to retain network | |
CVE-2026-66376 |
medium | 5.4 | 0.0022 | 2026-08-12 | Credentials for a deleted user may remain valid for a short period under specific conditions. | |
CVE-2026-41891 |
medium | 5.3 | 0.0027 | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture w |