Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (644)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-92588 |
medium | 5.9 | 0.0032 | 2026-09-16 | n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the sour | |
CVE-2026-19130 |
medium | 5.8 | 0.0040 | 2026-08-12 | A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An at | |
CVE-2026-5326 |
medium | 5.5 | 0.0040 | 2026-04-02 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknow | |
CVE-2026-5842 |
medium | 5.5 | 0.0039 | 2026-04-09 | A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is | |
CVE-2026-7681 |
medium | 5.5 | 0.0046 | 2026-05-03 | A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1. Affected by this | |
CVE-2026-7702 |
medium | 5.5 | 0.0031 | 2026-05-03 | A vulnerability was detected in toeverything AFFiNE up to 0.26.3. This issue affects the function al | |
CVE-2026-14753 |
medium | 5.5 | 0.0052 | 2026-07-05 | A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. | |
CVE-2026-15622 |
medium | 5.5 | 0.0059 | 2026-07-14 | A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file | |
CVE-2023-30059 |
medium | 5.4 | 0.0017 | 2026-05-12 | An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support | |
CVE-2026-20219 |
medium | 5.4 | 0.0017 | 2026-05-06 | A vulnerability in the REST API of Cisco Slido could have allowed an authenticated, remote attacker | |
CVE-2026-57646 |
medium | 5.4 | 0.0023 | 2026-06-26 | Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions. | |
CVE-2026-56823 |
medium | 5.4 | 0.0025 | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia | |
CVE-2026-52779 |
medium | 5.4 | 0.0022 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cro | |
CVE-2026-61064 |
medium | 5.4 | 0.0023 | 2026-07-21 | Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Up | |
CVE-2026-65463 |
medium | 5.4 | 0.0029 | 2026-07-23 | Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions. | |
CVE-2026-48052 |
medium | 5.4 | 0.0037 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an auth | |
CVE-2026-68076 |
medium | 5.4 | 0.0034 | 2026-08-12 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable | |
CVE-2026-59992 |
medium | 5.4 | 0.0038 | 2026-08-19 | Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0 | |
CVE-2026-76287 |
medium | 5.4 | 0.0021 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_managemen | |
CVE-2026-114698 |
medium | 5.4 | 0.0024 | 2026-10-22 | Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploi | |
CVE-2026-115994 |
medium | 5.4 | 0.0022 | 2026-10-24 | BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker m | |
CVE-2026-107445 |
medium | 5.4 | 0.0017 | 2026-10-08 | A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce auth | |
CVE-2026-42691 |
medium | 5.4 | — | 2026-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-e | |
CVE-2026-112294 |
medium | 5.3 | 0.0020 | 2026-10-19 | FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.count | |
CVE-2026-114079 |
medium | 5.3 | 0.0030 | 2026-10-21 | Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of low | |
CVE-2026-114393 |
medium | 5.3 | 0.0031 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated | |
CVE-2026-117563 |
medium | 5.3 | 0.0022 | 2026-10-27 | MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 br | |
CVE-2026-117605 |
medium | 5.3 | 0.0026 | 2026-10-28 | nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductControl | |
CVE-2026-117606 |
medium | 5.3 | 0.0028 | 2026-10-28 | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashi | |
CVE-2026-55561 |
medium | 5.3 | 0.0027 | 2026-10-28 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. | |
CVE-2026-33759 |
medium | 5.3 | 0.0031 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pla | |
CVE-2026-31950 |
medium | 5.3 | 0.0022 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the | |
CVE-2026-40252 |
medium | 5.3 | 0.0034 | 2026-04-10 | FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (I | |
CVE-2026-3307 |
medium | 5.3 | 0.0027 | 2026-04-21 | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an att | |
CVE-2026-7145 |
medium | 5.3 | 0.0024 | 2026-04-27 | A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of | |
CVE-2026-8027 |
medium | 5.3 | 0.0029 | 2026-05-06 | A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is | |
CVE-2026-27329 |
medium | 5.3 | 0.0032 | 2026-05-07 | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist all | |
CVE-2026-44341 |
medium | 5.3 | 0.0029 | 2026-05-12 | GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that | |
CVE-2026-46544 |
medium | 5.3 | 0.0046 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-56385 |
medium | 5.3 | 0.0036 | 2026-06-21 | Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypa | |
CVE-2026-56772 |
medium | 5.3 | 0.0033 | 2026-06-25 | NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated user | |
CVE-2026-57630 |
medium | 5.3 | 0.0031 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions | |
CVE-2026-57652 |
medium | 5.3 | 0.0031 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions. | |
CVE-2026-57665 |
medium | 5.3 | 0.0031 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions. | |
CVE-2026-53903 |
medium | 5.3 | 0.0041 | 2026-07-01 | MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servl | |
CVE-2026-50283 |
medium | 5.3 | 0.0036 | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 thr | |
CVE-2026-25782 |
medium | 5.3 | 0.0039 | 2026-07-03 | Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to t | |
CVE-2026-14793 |
medium | 5.3 | 0.0039 | 2026-07-06 | A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets | |
CVE-2026-46453 |
medium | 5.3 | 0.0055 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache | |
CVE-2026-48206 |
medium | 5.3 | 0.0055 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache |