Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-108142 |
critical | 9.1 | 0.0040 | 2026-10-27 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator | |
CVE-2026-40525 |
critical | 9.1 | 0.0057 | 2026-04-17 | OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot O | |
CVE-2026-70452 |
critical | 9.1 | 0.0046 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attacker | |
CVE-2026-50528 |
high | 8.2 | 0.0061 | 2026-07-14 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a | |
CVE-2026-69306 |
high | 8.2 | 0.0054 | 2026-08-11 | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypas | |
CVE-2026-53712 |
high | 8.2 | 0.0026 | 2026-07-17 | SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentic | |
CVE-2026-68746 |
high | 7.7 | 0.0080 | 2026-08-05 | Not Failing Securely ('Failing Open') vulnerability in livebook-dev livebook allows an unauthenticat | |
CVE-2026-35042 |
high | 7.5 | 0.0015 | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, fast-jwt does not | |
CVE-2026-74048 |
medium | 6.5 | 0.0023 | 2026-10-20 | Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListene | |
CVE-2026-114479 |
medium | 5.8 | 0.0032 | 2026-10-21 | Not failing securely in the anti-virus attachment-stripping action of Progressive Robot hMailServer | |
CVE-2026-45781 |
low | 3.5 | 0.0023 | 2026-05-14 | The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. | |
CVE-2026-53852 |
low | 2.3 | 0.0021 | 2026-06-16 | OpenClaw before 2026.4.25 contains a scope containment bypass vulnerability in device re-pairing tha | |
CVE-2026-62235 |
low | 2.3 | 0.0029 | 2026-07-17 | Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-n | |
CVE-2026-105933 |
low | 2.3 | 0.0029 | 2026-10-21 | Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a n | |
CVE-2026-110985 |
— | — | 0.0013 | 2026-10-28 | A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.cla |