Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-56147 |
high | 7.1 | 0.0035 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized inform | |
CVE-2026-65316 |
high | 7.1 | 0.0051 | 2026-07-21 | XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authent | |
CVE-2026-65710 |
high | 7.1 | 0.0030 | 2026-07-24 | sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authentica | |
CVE-2026-12945 |
high | 7.1 | 0.0036 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other user | |
CVE-2026-67329 |
high | 7.1 | 0.0031 | 2026-08-01 | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contai | |
CVE-2026-9130 |
high | 7.1 | 0.0030 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryCom | |
CVE-2026-70557 |
high | 7.1 | 0.0039 | 2026-08-06 | diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @T | |
CVE-2026-70561 |
high | 7.1 | 0.0037 | 2026-08-07 | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any | |
CVE-2026-72690 |
high | 7.1 | 0.0041 | 2026-08-10 | An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated | |
CVE-2026-72546 |
high | 7.1 | 0.0028 | 2026-08-11 | An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any aut | |
CVE-2026-72547 |
high | 7.1 | 0.0028 | 2026-08-11 | An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any aut | |
CVE-2026-72774 |
high | 7.1 | 0.0044 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Reque | |
CVE-2026-47704 |
high | 7.1 | 0.0056 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read acces | |
CVE-2026-48494 |
high | 7.1 | 0.0046 | 2026-08-11 | TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to a | |
CVE-2026-69117 |
high | 7.1 | 0.0032 | 2026-08-11 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including | |
CVE-2026-109164 |
high | 7.1 | 0.0031 | 2026-10-12 | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows | |
CVE-2026-109427 |
high | 7.1 | 0.0021 | 2026-10-12 | Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allow | |
CVE-2026-113606 |
high | 7.1 | 0.0036 | 2026-10-20 | Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenti | |
CVE-2026-115453 |
high | 7.1 | 0.0025 | 2026-10-22 | Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of | |
CVE-2026-104875 |
high | 7.1 | 0.0035 | 2026-10-13 | Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07. | |
CVE-2026-114392 |
medium | 6.9 | 0.0043 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated user | |
CVE-2026-116746 |
medium | 6.9 | 0.0025 | 2026-10-26 | QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview mod | |
CVE-2026-116810 |
medium | 6.9 | 0.0025 | 2026-10-27 | OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated at | |
CVE-2026-117562 |
medium | 6.9 | 0.0032 | 2026-10-27 | rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticate | |
CVE-2026-66091 |
medium | 6.9 | 0.0040 | 2026-10-29 | In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authenticat | |
CVE-2026-46721 |
medium | 6.9 | 0.0036 | 2026-05-19 | The create and edit flows do not restrict which user properties may be submitted and do not enforce | |
CVE-2026-46390 |
medium | 6.9 | 0.0034 | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and p | |
CVE-2026-53726 |
medium | 6.9 | 0.0028 | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node. | |
CVE-2026-56781 |
medium | 6.9 | 0.0040 | 2026-06-29 | Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allow | |
CVE-2026-59234 |
medium | 6.9 | 0.0064 | 2026-07-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Htt | |
CVE-2026-52837 |
medium | 6.9 | 0.0046 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the | |
CVE-2026-59236 |
medium | 6.9 | 0.0064 | 2026-07-15 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImp | |
CVE-2026-59237 |
medium | 6.9 | 0.0064 | 2026-07-16 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API contr | |
CVE-2026-59240 |
medium | 6.9 | 0.0048 | 2026-07-27 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationCont | |
CVE-2026-72802 |
medium | 6.9 | 0.0030 | 2026-08-12 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPat | |
CVE-2026-73606 |
medium | 6.9 | 0.0032 | 2026-08-13 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getR | |
CVE-2026-73610 |
medium | 6.9 | 0.0026 | 2026-08-13 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter th | |
CVE-2026-116745 |
medium | 6.9 | 0.0023 | 2026-10-26 | QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationControlle | |
CVE-2026-42291 |
medium | 6.8 | 0.0019 | 2026-05-08 | SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version | |
CVE-2026-6008 |
medium | 6.8 | 0.0022 | 2026-05-14 | Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, El | |
CVE-2026-4630 |
medium | 6.8 | 0.0030 | 2026-05-19 | A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Refere | |
CVE-2026-115706 |
medium | 6.8 | — | 2026-10-29 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lea | |
CVE-2026-54683 |
medium | 6.5 | 0.0042 | 2026-10-15 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact wi | |
CVE-2026-13319 |
medium | 6.5 | 0.0024 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 | |
CVE-2026-82411 |
medium | 6.5 | 0.0031 | 2026-10-28 | Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until | |
CVE-2026-85873 |
medium | 6.5 | 0.0096 | 2026-10-13 | Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to ele | |
CVE-2026-33141 |
medium | 6.5 | 0.0014 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Referenc | |
CVE-2026-33736 |
medium | 6.5 | 0.0021 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including | |
CVE-2026-40907 |
medium | 6.5 | 0.0027 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/ | |
CVE-2026-42725 |
medium | 6.5 | 0.0027 | 2026-05-27 | Authorization Bypass Through User-Controlled Key vulnerability in WP Wham Checkout Files Upload for |