Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65708 |
high | 8.6 | 0.0039 | 2026-07-24 | sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allow | |
CVE-2026-67348 |
high | 8.6 | 0.0032 | 2026-07-30 | Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoi | |
CVE-2026-19111 |
high | 8.6 | 0.0052 | 2026-08-06 | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools | |
CVE-2026-19433 |
high | 8.6 | 0.0044 | 2026-08-10 | Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prosp | |
CVE-2026-19734 |
high | 8.6 | 0.0059 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management | |
CVE-2026-72741 |
high | 8.6 | 0.0026 | 2026-08-13 | Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function tha | |
CVE-2026-63153 |
high | 8.6 | 0.0029 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectat | |
CVE-2026-59185 |
high | 8.5 | 0.0032 | 2026-10-28 | identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0 | |
CVE-2026-69250 |
high | 8.5 | 0.0057 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-67622 |
high | 8.5 | 0.0048 | 2026-08-06 | Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assis | |
CVE-2026-69857 |
high | 8.5 | 0.0063 | 2026-09-03 | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to | |
CVE-2026-55255 |
high | 8.4 | 0.0089 | 2026-06-23 | Langflow contains an authorization bypass through user-controlled key vulnerability which allows an | KEV |
CVE-2026-59979 |
high | 8.3 | 0.0029 | 2026-10-28 | YosemiteCrew provides organization-based service and task management. In the source-reported affecte | |
CVE-2026-46558 |
high | 8.3 | 0.0029 | 2026-06-10 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace | |
CVE-2026-47189 |
high | 8.3 | 0.0039 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-45732 |
high | 8.3 | 0.0035 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth | |
CVE-2026-47415 |
high | 8.3 | 0.0039 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-47419 |
high | 8.3 | 0.0034 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-70476 |
high | 8.3 | 0.0052 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-55739 |
high | 8.3 | 0.0037 | 2026-08-05 | Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both | |
CVE-2026-71242 |
high | 8.3 | 0.0037 | 2026-08-05 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with n | |
CVE-2026-49226 |
high | 8.3 | 0.0048 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-49224 |
high | 8.3 | 0.0048 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-49225 |
high | 8.3 | 0.0048 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-33946 |
high | 8.2 | 0.0047 | 2026-03-27 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to versi | |
CVE-2026-41279 |
high | 8.2 | 0.0026 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-41471 |
high | 8.2 | 0.0035 | 2026-05-04 | The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information dis | |
CVE-2026-54184 |
high | 8.2 | 0.0025 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. | |
CVE-2026-35147 |
high | 8.2 | 0.0043 | 2026-07-16 | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The applic | |
CVE-2026-61726 |
high | 8.1 | 0.0029 | 2026-10-16 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-85749 |
high | 8.1 | 0.0029 | 2026-10-28 | MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticate | |
CVE-2026-35045 |
high | 8.1 | 0.0027 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-39331 |
high | 8.1 | 0.0021 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can | |
CVE-2026-7399 |
high | 8.1 | 0.0033 | 2026-04-30 | Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. P | |
CVE-2026-6542 |
high | 8.1 | 0.0020 | 2026-04-30 | IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction lo | |
CVE-2026-42609 |
high | 8.1 | 0.0046 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav | |
CVE-2026-46407 |
high | 8.1 | 0.0022 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-45743 |
high | 8.1 | 0.0028 | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa | |
CVE-2026-7787 |
high | 8.1 | 0.0025 | 2026-06-11 | IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive i | |
CVE-2026-51924 |
high | 8.1 | 0.0057 | 2026-07-09 | An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the | |
CVE-2026-13445 |
high | 8.1 | 0.0035 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile | |
CVE-2026-47406 |
high | 8.1 | 0.0041 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-47417 |
high | 8.1 | 0.0036 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-47418 |
high | 8.1 | 0.0041 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-71308 |
high | 8.1 | 0.0032 | 2026-08-18 | Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit | |
CVE-2026-13169 |
high | 8.1 | 0.0035 | 2026-08-19 | The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allo | |
CVE-2026-115546 |
high | 8.1 | 0.0042 | 2026-10-23 | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An au | |
CVE-2026-34444 |
high | 7.9 | 0.0061 | 2026-04-06 | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is | |
CVE-2026-58650 |
high | 7.8 | 0.0032 | 2026-08-11 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attack | |
CVE-2026-33356 |
high | 7.7 | 0.0027 | 2026-05-11 | In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account |