Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-42999 |
high | 8.8 | 0.0033 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in en | |
CVE-2026-45830 |
high | 8.8 | 0.0034 | 2026-06-12 | A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows | |
CVE-2026-45832 |
high | 8.8 | 0.0028 | 2026-06-12 | All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database | |
CVE-2026-8828 |
high | 8.8 | 0.0028 | 2026-06-12 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any | |
CVE-2026-33760 |
high | 8.8 | 0.0050 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langf | |
CVE-2026-5523 |
high | 8.8 | 0.0044 | 2026-07-09 | The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, | |
CVE-2026-2398 |
high | 8.8 | 0.0045 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilM | |
CVE-2026-6212 |
high | 8.8 | 0.0044 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc | |
CVE-2026-47399 |
high | 8.8 | 0.0036 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to versio | |
CVE-2026-49258 |
high | 8.8 | 0.0048 | 2026-07-28 | Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and belo | |
CVE-2026-69258 |
high | 8.8 | 0.0067 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-18258 |
high | 8.8 | 0.0053 | 2026-08-06 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoint | |
CVE-2026-48169 |
high | 8.8 | 0.0044 | 2026-08-07 | PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have | |
CVE-2026-49221 |
high | 8.8 | 0.0055 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-49228 |
high | 8.8 | 0.0055 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-61574 |
high | 8.8 | 0.0062 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Con | |
CVE-2026-115748 |
high | 8.8 | 0.0061 | 2026-10-26 | **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vyspe | |
CVE-2026-34046 |
high | 8.7 | 0.0048 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5. | |
CVE-2026-25654 |
high | 8.7 | 0.0045 | 2026-04-14 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not | |
CVE-2026-6375 |
high | 8.7 | 0.0031 | 2026-04-23 | A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name recor | |
CVE-2026-44400 |
high | 8.7 | 0.0035 | 2026-05-08 | MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in | |
CVE-2026-59190 |
high | 8.7 | 0.0027 | 2026-07-10 | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and mod | |
CVE-2026-61460 |
high | 8.7 | 0.0051 | 2026-07-10 | Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadControlle | |
CVE-2026-59235 |
high | 8.7 | 0.0066 | 2026-07-15 | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/B | |
CVE-2026-62233 |
high | 8.7 | 0.0044 | 2026-07-17 | grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and | |
CVE-2026-13381 |
high | 8.7 | 0.0037 | 2026-07-20 | VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in | |
CVE-2026-65013 |
high | 8.7 | 0.0052 | 2026-07-22 | Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnera | |
CVE-2026-65917 |
high | 8.7 | 0.0051 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDO | |
CVE-2026-47743 |
high | 8.7 | 0.0038 | 2026-07-23 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir | |
CVE-2026-65709 |
high | 8.7 | 0.0039 | 2026-07-24 | sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JS | |
CVE-2026-57510 |
high | 8.7 | 0.0062 | 2026-07-28 | SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasSer | |
CVE-2026-67331 |
high | 8.7 | 0.0039 | 2026-08-01 | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM provider | |
CVE-2026-59233 |
high | 8.7 | 0.0041 | 2026-08-10 | Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2. | |
CVE-2026-19424 |
high | 8.7 | 0.0051 | 2026-08-11 | Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. | |
CVE-2026-56721 |
high | 8.7 | 0.0052 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure dir | |
CVE-2026-73298 |
high | 8.7 | 0.0097 | 2026-08-12 | The Microsoft Container Migration Solution Accelerator is a multi-service application that provides | |
CVE-2026-75103 |
high | 8.7 | 0.0062 | 2026-08-17 | Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allow | |
CVE-2026-63163 |
high | 8.7 | 0.0036 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileF | |
CVE-2026-115325 |
high | 8.7 | 0.0036 | 2026-10-22 | Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler | |
CVE-2026-116068 |
high | 8.7 | 0.0032 | 2026-10-25 | Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins | |
CVE-2026-116183 |
high | 8.7 | 0.0024 | 2026-10-25 | phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unaut | |
CVE-2026-109431 |
high | 8.6 | 0.0036 | 2026-10-19 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulne | |
CVE-2026-118668 |
high | 8.6 | 0.0037 | 2026-10-28 | langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15. | |
CVE-2026-69558 |
high | 8.6 | 0.0097 | 2026-08-20 | Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized | |
CVE-2026-7491 |
high | 8.6 | 0.0026 | 2026-05-02 | School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing auth | |
CVE-2026-42463 |
high | 8.6 | 0.0025 | 2026-05-13 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, | |
CVE-2026-8629 |
high | 8.6 | 0.0034 | 2026-05-14 | Crabbox prior to v0.12.0 contains a privilege escalation vulnerability that allows users with shared | |
CVE-2026-59712 |
high | 8.6 | 0.0045 | 2026-07-06 | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing aut | |
CVE-2026-55418 |
high | 8.6 | 0.0048 | 2026-07-07 | FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handl | |
CVE-2026-55604 |
high | 8.6 | 0.0037 | 2026-07-09 | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version |