Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-59817 |
medium | 5.3 | 0.0040 | 2026-07-09 | Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation che | |
CVE-2026-55478 |
medium | 5.3 | 0.0029 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licens | |
CVE-2026-15909 |
medium | 5.3 | 0.0037 | 2026-07-16 | A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3a | |
CVE-2026-65501 |
medium | 5.3 | 0.0031 | 2026-07-23 | Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 vers | |
CVE-2026-65696 |
medium | 5.3 | 0.0026 | 2026-07-23 | Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability | |
CVE-2026-18818 |
medium | 5.3 | 0.0037 | 2026-08-04 | A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the functio | |
CVE-2026-28180 |
medium | 5.3 | 0.0031 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= | |
CVE-2026-19064 |
medium | 5.3 | 0.0037 | 2026-08-06 | A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. Thi | |
CVE-2026-19066 |
medium | 5.3 | 0.0037 | 2026-08-06 | A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0 | |
CVE-2026-68870 |
medium | 5.3 | 0.0036 | 2026-08-10 | The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-sco | |
CVE-2026-19579 |
medium | 5.3 | 0.0034 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the ass | |
CVE-2026-18750 |
medium | 5.3 | 0.0032 | 2026-08-12 | vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and | |
CVE-2026-73039 |
medium | 5.3 | 0.0030 | 2026-08-13 | streama contains an insecure direct object reference vulnerability in ViewingStatusController that a | |
CVE-2026-16309 |
medium | 5.3 | 0.0031 | 2026-08-18 | Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies E | |
CVE-2026-74009 |
medium | 5.3 | 0.0029 | 2026-08-18 | Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versio | |
CVE-2026-50167 |
medium | 5.3 | 0.0046 | 2026-08-18 | Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2. | |
CVE-2026-16058 |
medium | 5.3 | 0.0032 | 2026-08-19 | The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on | |
CVE-2026-64969 |
medium | 5.3 | 0.0036 | 2026-08-20 | ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related en | |
CVE-2026-85611 |
medium | 5.3 | 0.0024 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in th | |
CVE-2026-85615 |
medium | 5.3 | 0.0024 | 2026-09-04 | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getL | |
CVE-2026-109176 |
medium | 5.3 | 0.0022 | 2026-10-12 | MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenti | |
CVE-2026-109287 |
medium | 5.3 | 0.0028 | 2026-10-12 | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file lis | |
CVE-2026-109296 |
medium | 5.3 | 0.0034 | 2026-10-12 | Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated us | |
CVE-2026-110122 |
medium | 5.3 | 0.0025 | 2026-10-13 | PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows | |
CVE-2026-110127 |
medium | 5.3 | 0.0025 | 2026-10-13 | waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile | |
CVE-2026-111603 |
medium | 5.3 | 0.0032 | 2026-10-16 | PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allo | |
CVE-2026-113349 |
medium | 5.3 | 0.0026 | 2026-10-20 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() a | |
CVE-2026-113600 |
medium | 5.3 | 0.0034 | 2026-10-20 | Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows au | |
CVE-2026-114389 |
medium | 5.3 | 0.0027 | 2026-10-21 | Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in A | |
CVE-2026-114394 |
medium | 5.3 | 0.0028 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated user | |
CVE-2026-114395 |
medium | 5.3 | 0.0031 | 2026-10-21 | Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allow | |
CVE-2026-100142 |
medium | 5.3 | 0.0030 | 2026-10-22 | The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored c | |
CVE-2026-115321 |
medium | 5.3 | 0.0028 | 2026-10-22 | Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment hand | |
CVE-2026-115322 |
medium | 5.3 | 0.0028 | 2026-10-22 | Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSe | |
CVE-2026-115326 |
medium | 5.3 | 0.0022 | 2026-10-22 | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailContr | |
CVE-2026-115803 |
medium | 5.3 | 0.0022 | 2026-10-24 | A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServlet | |
CVE-2026-116010 |
medium | 5.3 | 0.0020 | 2026-10-24 | RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated te | |
CVE-2026-116015 |
medium | 5.3 | 0.0022 | 2026-10-24 | yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall t | |
CVE-2026-116017 |
medium | 5.3 | 0.0023 | 2026-10-24 | Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the | |
CVE-2026-116018 |
medium | 5.3 | 0.0021 | 2026-10-24 | ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability | |
CVE-2026-116185 |
medium | 5.3 | 0.0019 | 2026-10-25 | OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticat | |
CVE-2026-97255 |
medium | 5.3 | 0.0028 | 2026-10-26 | Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons roy | |
CVE-2026-116340 |
medium | 5.3 | 0.0030 | 2026-10-26 | A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileIn | |
CVE-2026-85173 |
medium | 5.3 | 0.0035 | 2026-09-03 | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights | |
CVE-2025-40773 |
medium | 5.1 | 0.0020 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server appl | |
CVE-2026-111648 |
medium | 5.1 | 0.0038 | 2026-10-16 | BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows auth | |
CVE-2026-111658 |
medium | 5.1 | 0.0032 | 2026-10-16 | SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController | |
CVE-2026-27881 |
medium | 5.0 | 0.0027 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-27883 |
medium | 5.0 | 0.0026 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-34167 |
medium | 5.0 | 0.0025 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. |