Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-47238 |
medium | 6.5 | 0.0024 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal auth | |
CVE-2026-48067 |
medium | 6.5 | 0.0030 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From filament | |
CVE-2026-54324 |
medium | 6.5 | 0.0046 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-56013 |
medium | 6.5 | 0.0033 | 2026-06-25 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.1 | |
CVE-2026-56048 |
medium | 6.5 | 0.0033 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts | |
CVE-2026-44736 |
medium | 6.5 | 0.0036 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/ | |
CVE-2026-57341 |
medium | 6.5 | 0.0033 | 2026-06-29 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livrais | |
CVE-2026-57680 |
medium | 6.5 | 0.0033 | 2026-07-02 | Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions. | |
CVE-2026-49296 |
medium | 6.5 | 0.0060 | 2026-07-07 | Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Da | |
CVE-2026-57694 |
medium | 6.5 | 0.0034 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exp | |
CVE-2026-45295 |
medium | 6.5 | 0.0024 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-47408 |
medium | 6.5 | 0.0029 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-61946 |
medium | 6.5 | 0.0033 | 2026-07-23 | Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions. | |
CVE-2026-47755 |
medium | 6.5 | 0.0035 | 2026-07-23 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service provi | |
CVE-2026-10700 |
medium | 6.5 | 0.0054 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its | |
CVE-2026-68501 |
medium | 6.5 | 0.0060 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3. | |
CVE-2026-48912 |
medium | 6.5 | 0.0047 | 2026-08-05 | Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through | |
CVE-2026-18275 |
medium | 6.5 | 0.0039 | 2026-08-06 | Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium thro | |
CVE-2026-64662 |
medium | 6.5 | 0.0042 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, a | |
CVE-2026-68871 |
medium | 6.5 | 0.0036 | 2026-08-10 | The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connec | |
CVE-2026-68872 |
medium | 6.5 | 0.0060 | 2026-08-10 | The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon prov | |
CVE-2026-73239 |
medium | 6.5 | 0.0062 | 2026-08-12 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types | |
CVE-2026-18744 |
medium | 6.5 | 0.0043 | 2026-08-12 | Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberSt | |
CVE-2026-28155 |
medium | 6.5 | 0.0033 | 2026-08-13 | Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions. | |
CVE-2026-63669 |
medium | 6.5 | 0.0031 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module' | |
CVE-2026-63178 |
medium | 6.5 | 0.0052 | 2026-08-17 | Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/us | |
CVE-2026-73395 |
medium | 6.5 | 0.0033 | 2026-08-18 | Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking Sy | |
CVE-2026-69160 |
medium | 6.5 | 0.0040 | 2026-08-18 | OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and | |
CVE-2026-13175 |
medium | 6.5 | 0.0042 | 2026-08-19 | The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule recor | |
CVE-2026-68559 |
medium | 6.5 | 0.0040 | 2026-08-19 | Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/export | |
CVE-2026-54622 |
medium | 6.5 | 0.0042 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-63003 |
medium | 6.5 | 0.0042 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-37979 |
medium | 6.5 | 0.0039 | 2026-05-19 | A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) | |
CVE-2026-118084 |
medium | 6.5 | — | 2026-10-29 | Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions. | |
CVE-2026-118760 |
medium | 6.5 | — | 2026-10-29 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. | |
CVE-2026-64927 |
medium | 6.4 | 0.0033 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user wit | |
CVE-2026-115804 |
medium | 6.4 | 0.0029 | 2026-10-26 | HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check reg | |
CVE-2026-64961 |
medium | 6.3 | 0.0048 | 2026-08-20 | ATutor is vulnerable to authentication bypass . Although a token validation check is present in the | |
CVE-2026-40792 |
medium | 6.3 | 0.0025 | 2026-06-15 | Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions. | |
CVE-2026-13490 |
medium | 6.3 | 0.0046 | 2026-06-28 | A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects t | |
CVE-2026-59254 |
medium | 6.3 | 0.0036 | 2026-07-15 | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorr | |
CVE-2026-116187 |
medium | 6.1 | 0.0014 | 2026-10-25 | Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth | |
CVE-2026-110620 |
medium | 6.1 | 0.0056 | 2026-10-14 | Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetS | |
CVE-2026-114077 |
medium | 6.1 | 0.0035 | 2026-10-21 | Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroun | |
CVE-2026-114091 |
medium | 6.0 | 0.0034 | 2026-10-21 | Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route | |
CVE-2026-59259 |
medium | 6.0 | 0.0044 | 2026-07-15 | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in exter | |
CVE-2026-73488 |
medium | 6.0 | 0.0037 | 2026-08-13 | Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET / | |
CVE-2026-115329 |
medium | 6.0 | 0.0026 | 2026-10-22 | Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewS | |
CVE-2026-2270 |
medium | 5.9 | 0.0034 | 2026-10-26 | A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scop | |
CVE-2026-54590 |
medium | 5.9 | 0.0034 | 2026-07-08 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the |