Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-113727 |
high | 7.4 | 0.0046 | 2026-10-20 | OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT | |
CVE-2026-35489 |
high | 7.3 | 0.0022 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-40768 |
high | 7.3 | 0.0029 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 version | |
CVE-2026-71417 |
high | 7.3 | 0.0010 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a no | |
CVE-2026-114066 |
high | 7.2 | 0.0027 | 2026-10-21 | Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unres | |
CVE-2026-114068 |
high | 7.2 | 0.0037 | 2026-10-21 | Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait | |
CVE-2026-114078 |
high | 7.2 | 0.0042 | 2026-10-21 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService | |
CVE-2026-5845 |
high | 7.2 | 0.0029 | 2026-04-21 | An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHu | |
CVE-2026-72763 |
high | 7.2 | 0.0036 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level cred | |
CVE-2026-69119 |
high | 7.2 | 0.0046 | 2026-08-11 | Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service | |
CVE-2026-119049 |
high | 7.2 | — | 2026-10-29 | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users | |
CVE-2026-58660 |
high | 7.2 | 0.0050 | 2026-07-15 | Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanb | |
CVE-2026-77768 |
high | 7.1 | 0.0042 | 2026-08-21 | The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returne | |
CVE-2026-77769 |
high | 7.1 | 0.0042 | 2026-08-21 | The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboar | |
CVE-2026-110613 |
high | 7.1 | 0.0042 | 2026-10-14 | youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authen | |
CVE-2026-116898 |
high | 7.1 | 0.0017 | 2026-10-27 | REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that | |
CVE-2026-116899 |
high | 7.1 | 0.0018 | 2026-10-27 | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editor | |
CVE-2026-32894 |
high | 7.1 | 0.0028 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Obj | |
CVE-2026-32930 |
high | 7.1 | 0.0019 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Obj | |
CVE-2026-33702 |
high | 7.1 | 0.0024 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains a | |
CVE-2026-33703 |
high | 7.1 | 0.0017 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Referenc | |
CVE-2026-40043 |
high | 7.1 | 0.0038 | 2026-04-13 | Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allo | |
CVE-2026-40480 |
high | 7.1 | 0.0040 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/perso | |
CVE-2026-40896 |
high | 7.1 | 0.0017 | 2026-04-20 | OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user w | |
CVE-2026-40865 |
high | 7.1 | 0.0017 | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure dir | |
CVE-2026-42515 |
high | 7.1 | 0.0023 | 2026-04-29 | This vulnerability exists in e-Sushrut due to improper access control in resource access validation. | |
CVE-2026-42516 |
high | 7.1 | 0.0023 | 2026-04-29 | This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. | |
CVE-2026-42517 |
high | 7.1 | 0.0023 | 2026-04-29 | This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting s | |
CVE-2026-8406 |
high | 7.1 | 0.0030 | 2026-06-11 | openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging modu | |
CVE-2026-55197 |
high | 7.1 | 0.0035 | 2026-06-17 | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endp | |
CVE-2026-55198 |
high | 7.1 | 0.0035 | 2026-06-17 | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export en | |
CVE-2026-48759 |
high | 7.1 | 0.0020 | 2026-06-17 | TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Referenc | |
CVE-2026-50141 |
high | 7.1 | 0.0043 | 2026-06-18 | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability | |
CVE-2026-49338 |
high | 7.1 | 0.0029 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to versi | |
CVE-2026-49339 |
high | 7.1 | 0.0031 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. The maintainer | |
CVE-2026-58447 |
high | 7.1 | 0.0027 | 2026-06-30 | Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorizatio | |
CVE-2026-59098 |
high | 7.1 | 0.0042 | 2026-07-02 | LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-gen | |
CVE-2026-28740 |
high | 7.1 | 0.0032 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj | |
CVE-2026-54602 |
high | 7.1 | 0.0036 | 2026-07-07 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRe | |
CVE-2026-35210 |
high | 7.1 | 0.0035 | 2026-07-08 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | |
CVE-2026-41878 |
high | 7.1 | 0.0047 | 2026-07-10 | R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download | |
CVE-2026-58410 |
high | 7.1 | 0.0021 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authoriza | |
CVE-2026-52869 |
high | 7.1 | 0.0053 | 2026-07-15 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC | |
CVE-2026-11889 |
high | 7.1 | 0.0031 | 2026-07-16 | SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a pri | |
CVE-2026-22104 |
high | 7.1 | 0.0045 | 2026-07-17 | Improper access control in Hashtopolis server web-interface chunk activity component for versions pr | |
CVE-2026-63095 |
high | 7.1 | 0.0030 | 2026-07-17 | Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server | |
CVE-2026-63099 |
high | 7.1 | 0.0035 | 2026-07-17 | TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment | |
CVE-2026-63307 |
high | 7.1 | 0.0040 | 2026-07-17 | Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/conn | |
CVE-2026-47130 |
high | 7.1 | 0.0020 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 hav | |
CVE-2026-57494 |
high | 7.1 | 0.0027 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to ver |