Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2605)
CWE-79 (1759)
CWE-416 (1278)
CWE-862 (1115)
CWE-89 (1087)
CWE-22 (1001)
CWE-125 (857)
CWE-200 (835)
CWE-306 (829)
CWE-122 (821)
CWE-20 (783)
CWE-78 (695)
CWE-918 (679)
CWE-787 (672)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (527)
CWE-400 (509)
CWE-269 (499)
CWE-119 (493)
CWE-770 (426)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (370)
CWE-190 (359)
CWE-362 (319)
CWE-352 (269)
CWE-285 (238)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2024-34323 |
critical | 10.0 | 0.0036 | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (I | |
CVE-2026-77995 |
critical | 10.0 | 0.0041 | 2026-08-24 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, O | |
CVE-2026-69865 |
critical | 10.0 | 0.0080 | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori | |
CVE-2026-94510 |
critical | 9.9 | 0.0057 | 2026-10-08 | Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attack | |
CVE-2026-29200 |
critical | 9.9 | 0.0030 | 2026-05-04 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11. | |
CVE-2026-52782 |
critical | 9.9 | 0.0045 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there | |
CVE-2026-34037 |
critical | 9.9 | 0.0037 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-54052 |
critical | 9.9 | 0.0039 | 2026-07-15 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, a | |
CVE-2026-48765 |
critical | 9.9 | 0.0046 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator | |
CVE-2025-58627 |
critical | 9.8 | 0.0045 | 2025-11-06 | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugi | |
CVE-2026-41267 |
critical | 9.8 | 0.0033 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-24178 |
critical | 9.8 | 0.0057 | 2026-04-28 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system w | |
CVE-2026-2347 |
critical | 9.8 | 0.0043 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Akilli Commerce Software Technolog | |
CVE-2026-2346 |
critical | 9.8 | 0.0051 | 2026-08-03 | Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App a | |
CVE-2026-18749 |
critical | 9.8 | 0.0051 | 2026-08-12 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttac | |
CVE-2026-12411 |
critical | 9.6 | 0.0029 | 2026-06-26 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust | |
CVE-2026-57498 |
critical | 9.6 | 0.0032 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-10140 |
critical | 9.6 | 0.0035 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows | |
CVE-2026-55518 |
critical | 9.6 | 0.0041 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, | |
CVE-2026-16624 |
critical | 9.6 | 0.0036 | 2026-07-22 | Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to | |
CVE-2026-72564 |
critical | 9.6 | 0.0044 | 2026-08-10 | An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated re | |
CVE-2026-73644 |
critical | 9.6 | 0.0041 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identi | |
CVE-2026-12693 |
critical | 9.4 | 0.0046 | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Pla | |
CVE-2026-47407 |
critical | 9.4 | 0.0030 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to versio | |
CVE-2026-1496 |
critical | 9.3 | 0.0055 | 2026-03-27 | Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for comman | |
CVE-2026-42097 |
critical | 9.3 | 0.0094 | 2026-05-19 | Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "mod | |
CVE-2026-12686 |
critical | 9.3 | 0.0037 | 2026-07-06 | An authenticated user could manipulate a company ID parameter in a POST request to the backend to ga | |
CVE-2026-60104 |
critical | 9.3 | 0.0037 | 2026-07-08 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-reque | |
CVE-2026-17349 |
critical | 9.3 | 0.0040 | 2026-07-31 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, wh | |
CVE-2026-67342 |
critical | 9.3 | 0.0054 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for t | |
CVE-2026-68582 |
critical | 9.3 | 0.0033 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerabi | |
CVE-2026-117574 |
critical | 9.1 | — | 2026-10-28 | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this | |
CVE-2026-29204 |
critical | 9.1 | 0.0032 | 2026-05-12 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit | |
CVE-2026-42889 |
critical | 9.1 | 0.0037 | 2026-05-12 | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an | |
CVE-2026-28302 |
critical | 9.1 | 0.0079 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l | |
CVE-2026-28305 |
critical | 9.1 | 0.0079 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l | |
CVE-2026-28308 |
critical | 9.1 | 0.0079 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l | |
CVE-2026-28313 |
critical | 9.1 | 0.0050 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l | |
CVE-2026-28314 |
critical | 9.1 | 0.0062 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an | |
CVE-2026-28316 |
critical | 9.1 | 0.0213 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l | |
CVE-2026-28317 |
critical | 9.1 | 0.0050 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l | |
CVE-2026-5652 |
critical | 9.0 | 0.0044 | 2026-04-21 | An insecure direct object reference vulnerability in the Users API component of Crafty Controller al | |
CVE-2026-45746 |
critical | 9.0 | 0.0039 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-45750 |
critical | 9.0 | 0.0029 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-70185 |
high | 8.8 | 0.0031 | 2026-10-13 | Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a securit | |
CVE-2026-116672 |
high | 8.8 | 0.0027 | 2026-10-27 | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, th | |
CVE-2026-39386 |
high | 8.8 | 0.0044 | 2026-04-21 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 throug | |
CVE-2026-42278 |
high | 8.8 | 0.0045 | 2026-05-08 | UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine | |
CVE-2026-6001 |
high | 8.8 | 0.0024 | 2026-05-12 | Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS al | |
CVE-2026-46414 |
high | 8.8 | 0.0059 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. |