Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-48783 |
medium | 4.8 | 0.0017 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated | |
CVE-2026-93634 |
medium | 4.3 | 0.0027 | 2026-10-23 | A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authentica | |
CVE-2026-16307 |
medium | 4.3 | 0.0019 | 2026-10-27 | Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies E | |
CVE-2026-33764 |
medium | 4.3 | 0.0022 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's | |
CVE-2026-28736 |
medium | 4.3 | 0.0022 | 2026-04-03 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving | |
CVE-2026-31956 |
medium | 4.3 | 0.0027 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-57634 |
medium | 4.3 | 0.0025 | 2026-06-26 | Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions. | |
CVE-2026-44731 |
medium | 4.3 | 0.0029 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the w | |
CVE-2026-44732 |
medium | 4.3 | 0.0028 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenP | |
CVE-2026-49355 |
medium | 4.3 | 0.0029 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/mee | |
CVE-2026-57676 |
medium | 4.3 | 0.0029 | 2026-06-29 | Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar al | |
CVE-2026-27956 |
medium | 4.3 | 0.0029 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-54568 |
medium | 4.3 | 0.0059 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3. | |
CVE-2026-57205 |
medium | 4.3 | 0.0091 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-g | |
CVE-2026-15159 |
medium | 4.3 | 0.0028 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Referenc | |
CVE-2026-63259 |
medium | 4.3 | 0.0029 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclos | |
CVE-2026-17570 |
medium | 4.3 | 0.0025 | 2026-07-27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authen | |
CVE-2026-63242 |
medium | 4.3 | 0.0025 | 2026-07-29 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson c | |
CVE-2026-66692 |
medium | 4.3 | 0.0027 | 2026-08-06 | Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour | |
CVE-2026-66764 |
medium | 4.3 | 0.0028 | 2026-08-11 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks fo | |
CVE-2026-66634 |
medium | 4.3 | 0.0027 | 2026-08-18 | Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions. | |
CVE-2026-14196 |
medium | 4.3 | 0.0025 | 2026-08-19 | The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a | |
CVE-2026-61663 |
medium | 4.3 | 0.0034 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-112868 |
medium | 4.3 | 0.0027 | 2026-10-21 | Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Inco | |
CVE-2026-113489 |
medium | 4.3 | 0.0020 | 2026-10-24 | The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belon | |
CVE-2026-115998 |
medium | 4.3 | 0.0020 | 2026-10-24 | IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findin | |
CVE-2026-108763 |
medium | 4.3 | 0.0014 | 2026-10-29 | The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document | |
CVE-2026-105272 |
medium | 4.2 | 0.0018 | 2026-10-28 | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionalit | |
CVE-2026-109848 |
medium | 4.2 | 0.0022 | 2026-10-28 | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API d | |
CVE-2026-43883 |
medium | 4.2 | 0.0020 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT | |
CVE-2026-111961 |
low | 3.8 | 0.0019 | 2026-10-28 | The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check befo | |
CVE-2026-114741 |
low | 3.8 | 0.0015 | 2026-10-25 | The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when read | |
CVE-2026-113665 |
low | 3.7 | 0.0035 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification | |
CVE-2026-52839 |
low | 3.3 | 0.0018 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter p | |
CVE-2026-87098 |
low | 3.1 | 0.0018 | 2026-10-28 | Sensitive information disclosure due to improper authorization. The following products are affected: | |
CVE-2026-52841 |
low | 3.1 | 0.0021 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth | |
CVE-2026-15058 |
low | 3.1 | 0.0021 | 2026-07-14 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 202 | |
CVE-2026-63241 |
low | 3.1 | 0.0022 | 2026-07-29 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to qu | |
CVE-2026-5246 |
low | 2.9 | 0.0062 | 2026-04-02 | A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verif | |
CVE-2026-61971 |
low | 2.7 | 0.0031 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture me | |
CVE-2026-14825 |
low | 2.7 | 0.0028 | 2026-08-19 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object owner | |
CVE-2026-14826 |
low | 2.7 | 0.0030 | 2026-08-19 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object owner | |
CVE-2026-114742 |
low | 2.7 | 0.0017 | 2026-10-25 | The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating | |
CVE-2026-115725 |
low | 2.3 | 0.0024 | 2026-10-23 | Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agen | |
CVE-2026-13350 |
low | 2.3 | 0.0027 | 2026-06-25 | Permissions where checked incorrectly during room creation, allowing attackers to create rooms of ty | |
CVE-2026-65699 |
low | 2.3 | 0.0028 | 2026-07-23 | AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability th | |
CVE-2026-18028 |
low | 2.3 | 0.0035 | 2026-07-28 | The "quick setup" view presented to users after they first create an event allows to set up the mos | |
CVE-2026-46712 |
low | 2.3 | 0.0036 | 2026-08-03 | Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior t | |
CVE-2026-111169 |
low | 2.3 | 0.0027 | 2026-10-15 | La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated | |
CVE-2026-111608 |
low | 2.3 | 0.0030 | 2026-10-16 | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenti |