Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-34348 |
medium | 6.5 | 0.0100 | 2026-07-14 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to discl | 1 PoC |
CVE-2026-5276 |
medium | 6.5 | 0.0025 | 2026-04-01 | Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote | |
CVE-2026-6763 |
medium | 6.5 | 0.0019 | 2026-04-21 | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firef | |
CVE-2026-12302 |
medium | 6.5 | 0.0025 | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firef | |
CVE-2026-13862 |
medium | 6.5 | 0.0025 | 2026-06-30 | Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on | |
CVE-2026-13876 |
medium | 6.5 | 0.0023 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker | |
CVE-2026-13886 |
medium | 6.5 | 0.0026 | 2026-06-30 | Insufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed | |
CVE-2026-13904 |
medium | 6.5 | 0.0026 | 2026-06-30 | Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed | |
CVE-2026-13910 |
medium | 6.5 | 0.0032 | 2026-06-30 | Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed | |
CVE-2026-14050 |
medium | 6.5 | 0.0032 | 2026-06-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remot | |
CVE-2026-14059 |
medium | 6.5 | 0.0032 | 2026-06-30 | Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allo | |
CVE-2026-66391 |
medium | 6.5 | 0.0064 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. T | |
CVE-2026-17674 |
medium | 6.5 | 0.0030 | 2026-07-30 | Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attack | |
CVE-2026-17764 |
medium | 6.5 | 0.0030 | 2026-07-30 | Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attac | |
CVE-2026-17882 |
medium | 6.5 | 0.0023 | 2026-07-30 | Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convince | |
CVE-2026-17923 |
medium | 6.5 | 0.0027 | 2026-07-30 | Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to byp | |
CVE-2026-17931 |
medium | 6.5 | 0.0030 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17936 |
medium | 6.5 | 0.0024 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-87878 |
medium | 6.3 | 0.0014 | 2026-10-28 | Linux binaries have executable stack attribute enabled. The following products are affected: Acronis | |
CVE-2026-46403 |
medium | 6.3 | 0.0048 | 2026-07-21 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ` | |
CVE-2026-48037 |
medium | 6.3 | 0.0045 | 2026-07-24 | Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure comp | |
CVE-2026-112077 |
medium | 6.3 | 0.0029 | 2026-10-19 | A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_cor | |
CVE-2026-50661 |
medium | 6.1 | 0.0048 | 2026-07-14 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a securi | |
CVE-2026-49458 |
medium | 6.1 | 0.0040 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DO | |
CVE-2026-49459 |
medium | 6.1 | 0.0037 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DO | |
CVE-2026-56087 |
medium | 6.1 | 0.0021 | 2026-07-15 | Dell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. | |
CVE-2026-46638 |
medium | 6.0 | 0.0047 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a templ | |
CVE-2026-48808 |
medium | 6.0 | 0.0041 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st | |
CVE-2026-49981 |
medium | 6.0 | 0.0036 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all | |
CVE-2026-44003 |
medium | 5.8 | 0.0025 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performa | |
CVE-2026-0278 |
medium | 5.8 | 0.0015 | 2026-07-09 | Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) compone | |
CVE-2026-17776 |
medium | 5.8 | 0.0019 | 2026-07-30 | Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had | |
CVE-2024-36315 |
medium | 5.7 | 0.0014 | 2026-05-13 | Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculatio | |
CVE-2026-0293 |
medium | 5.6 | 0.0016 | 2026-08-13 | A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with | |
CVE-2026-113730 |
medium | 5.6 | 0.0039 | 2026-10-20 | OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocati | |
CVE-2026-28914 |
medium | 5.5 | 0.0020 | 2026-05-11 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8 | |
CVE-2026-28849 |
medium | 5.5 | 0.0016 | 2026-07-27 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Son | |
CVE-2026-28900 |
medium | 5.5 | 0.0016 | 2026-07-27 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia | |
CVE-2026-64708 |
medium | 5.5 | 0.0017 | 2026-07-27 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia | |
CVE-2026-6774 |
medium | 5.4 | 0.0015 | 2026-04-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Th | |
CVE-2026-17779 |
medium | 5.4 | 0.0026 | 2026-07-30 | Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a rem | |
CVE-2026-22013 |
medium | 5.3 | 0.0026 | 2026-04-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ | |
CVE-2026-22707 |
medium | 5.3 | 0.0019 | 2026-05-14 | Strapi is an open source headless content management system. In Strapi versions prior to 5.33.3, the | |
CVE-2026-8583 |
medium | 5.3 | 0.0018 | 2026-05-14 | Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed | |
CVE-2026-44646 |
medium | 5.3 | 0.0033 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version | |
CVE-2026-53949 |
medium | 5.3 | 0.0036 | 2026-06-24 | Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to fi | |
CVE-2026-48805 |
medium | 5.3 | 0.0048 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/ | |
CVE-2026-115480 |
medium | 5.3 | 0.0032 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-49859 |
medium | 5.2 | 0.0014 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, when fetch() was called, | |
CVE-2026-41469 |
medium | 5.1 | 0.0020 | 2026-04-22 | Beghelli Sicuro24 SicuroWeb does not enforce a Content Security Policy, allowing unrestricted loadin |