Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-33356 |
high | 7.7 | 0.0027 | 2026-05-11 | In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account | |
CVE-2026-54322 |
high | 7.7 | 0.0030 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-34592 |
high | 7.7 | 0.0034 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-34044 |
high | 7.7 | 0.0040 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-55516 |
high | 7.7 | 0.0038 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances | |
CVE-2026-48799 |
high | 7.7 | 0.0022 | 2026-07-15 | Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IP | |
CVE-2026-65016 |
high | 7.7 | 0.0045 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Ent | |
CVE-2026-17527 |
high | 7.7 | 0.0057 | 2026-07-27 | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to p | |
CVE-2026-66878 |
high | 7.7 | 0.0048 | 2026-08-12 | A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace a | |
CVE-2026-41277 |
high | 7.6 | 0.0311 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-46408 |
high | 7.6 | 0.0025 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-48599 |
high | 7.6 | 0.0034 | 2026-06-15 | Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authentica | |
CVE-2026-55583 |
high | 7.6 | 0.0023 | 2026-06-24 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was | |
CVE-2026-54826 |
high | 7.6 | 0.0031 | 2026-06-26 | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. | |
CVE-2026-55544 |
high | 7.6 | 0.0022 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP c | |
CVE-2026-47414 |
high | 7.6 | 0.0038 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-49227 |
high | 7.6 | 0.0042 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-19869 |
high | 7.6 | 0.0049 | 2026-08-18 | @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication ru | |
CVE-2026-49222 |
high | 7.6 | 0.0042 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-49223 |
high | 7.6 | 0.0042 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-115334 |
high | 7.6 | 0.0024 | 2026-10-22 | Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.po | |
CVE-2026-96581 |
high | 7.6 | 0.0026 | 2026-10-26 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of o | |
CVE-2025-63248 |
high | 7.5 | 0.0032 | 2025-11-05 | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing | |
CVE-2026-51367 |
high | 7.5 | 0.0060 | 2026-08-19 | An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive i | |
CVE-2026-4503 |
high | 7.5 | 0.0034 | 2026-04-30 | IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other | |
CVE-2026-42736 |
high | 7.5 | 0.0026 | 2026-05-27 | Authorization Bypass Through User-Controlled Key vulnerability in wordplus BP Better Messages bp-bet | |
CVE-2026-48868 |
high | 7.5 | 0.0028 | 2026-06-15 | Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions. | |
CVE-2026-48872 |
high | 7.5 | 0.0035 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions. | |
CVE-2026-52699 |
high | 7.5 | 0.0023 | 2026-06-15 | Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions. | |
CVE-2026-54839 |
high | 7.5 | 0.0039 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone &a | |
CVE-2026-56069 |
high | 7.5 | 0.0043 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions. | |
CVE-2026-27657 |
high | 7.5 | 0.0045 | 2026-07-03 | Gitea versions before 1.25.5 allow a user to change another user's primary email address. | |
CVE-2026-46585 |
high | 7.5 | 0.0063 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache | |
CVE-2026-5730 |
high | 7.5 | 0.0042 | 2026-07-07 | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Se | |
CVE-2026-5799 |
high | 7.5 | 0.0042 | 2026-07-07 | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Se | |
CVE-2026-1989 |
high | 7.5 | 0.0043 | 2026-07-09 | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solution | |
CVE-2026-14165 |
high | 7.5 | 0.0042 | 2026-07-13 | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Editio | |
CVE-2026-15637 |
high | 7.5 | 0.0025 | 2026-07-14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server | |
CVE-2026-43977 |
high | 7.5 | 0.0029 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated | |
CVE-2026-59539 |
high | 7.5 | 0.0035 | 2026-07-27 | Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions. | |
CVE-2026-68500 |
high | 7.5 | 0.0068 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3. | |
CVE-2026-65523 |
high | 7.5 | 0.0039 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contra | |
CVE-2026-72689 |
high | 7.5 | 0.0053 | 2026-08-10 | A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allo | |
CVE-2026-72543 |
high | 7.5 | 0.0061 | 2026-08-11 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows una | |
CVE-2026-72545 |
high | 7.5 | 0.0054 | 2026-08-11 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows una | |
CVE-2026-14861 |
high | 7.5 | 0.0044 | 2026-08-19 | The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request | |
CVE-2026-111417 |
high | 7.5 | 0.0043 | 2026-10-29 | A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion | |
CVE-2026-119325 |
high | 7.5 | — | 2026-10-29 | Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerab | |
CVE-2026-59546 |
high | 7.4 | 0.0039 | 2026-07-27 | Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. | |
CVE-2026-77079 |
high | 7.4 | 0.0045 | 2026-08-20 | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (r |