Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2637)
CWE-79 (1880)
CWE-416 (1379)
CWE-862 (1214)
CWE-89 (1112)
CWE-22 (1032)
CWE-125 (931)
CWE-306 (858)
CWE-200 (854)
CWE-122 (832)
CWE-20 (801)
CWE-787 (728)
CWE-78 (721)
CWE-918 (699)
CWE-863 (657)
CWE-94 (647)
CWE-74 (603)
CWE-639 (568)
CWE-400 (535)
CWE-119 (504)
CWE-269 (503)
CWE-502 (477)
CWE-770 (449)
CWE-287 (442)
CWE-121 (410)
CWE-190 (380)
CWE-77 (375)
CWE-362 (374)
CWE-476 (303)
CWE-352 (287)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40875 |
high | 7.0 | 0.0024 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-41653 |
high | 7.0 | 0.0036 | 2026-05-07 | BentoPDF is a client-side PDF toolkit that is self hostable. Prior to version 2.8.3, a cross-site sc | |
CVE-2026-54301 |
high | 7.0 | 0.0024 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authen | |
CVE-2026-54302 |
high | 7.0 | 0.0023 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, an authen | |
CVE-2026-8699 |
high | 7.0 | 0.0028 | 2026-07-02 | A stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management in | |
CVE-2026-58411 |
high | 7.0 | 0.0043 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting ( | |
CVE-2026-9588 |
high | 7.0 | 0.0040 | 2026-07-17 | A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (10499 | |
CVE-2026-75531 |
high | 7.0 | 0.0044 | 2026-08-17 | Pandora contains a stored cross-site scripting (XSS) vulnerability in the rendering of URL observabl | |
CVE-2024-5540 |
medium | 6.9 | 0.0034 | 2025-11-27 | The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions | |
CVE-2025-11183 |
medium | 6.9 | 0.0042 | 2025-10-13 | Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized | |
CVE-2025-11184 |
medium | 6.9 | 0.0042 | 2025-10-13 | Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized | |
CVE-2026-39422 |
medium | 6.9 | 0.0022 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross | |
CVE-2026-39423 |
medium | 6.9 | 0.0017 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain an Eval Inject | |
CVE-2026-41238 |
medium | 6.9 | 0.0027 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions 3.0.1 thr | |
CVE-2026-42138 |
medium | 6.9 | 0.0024 | 2026-05-04 | Dify is an open-source LLM app development platform. Prior to version 1.13.1, using the method POST | |
CVE-2026-42841 |
medium | 6.9 | 0.0042 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with page editing pe | |
CVE-2026-53693 |
medium | 6.9 | 0.0028 | 2026-06-10 | A stored cross-site scripting vulnerability existed in MISP BSimVis tag rendering code. Several clie | |
CVE-2026-13083 |
medium | 6.9 | 0.0030 | 2026-06-26 | A flaw was found in the Pen Drive report generator. Cluster-sourced data is rendered into HTML repor | |
CVE-2026-58519 |
medium | 6.9 | 0.0024 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-14358 |
medium | 6.9 | 0.0030 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-55791 |
medium | 6.9 | 0.0046 | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5. | |
CVE-2026-59238 |
medium | 6.9 | 0.0056 | 2026-07-20 | Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, r | |
CVE-2026-53668 |
medium | 6.9 | 0.0034 | 2026-07-27 | React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, appl | |
CVE-2026-18243 |
medium | 6.9 | 0.0029 | 2026-08-03 | Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may | |
CVE-2026-71446 |
medium | 6.9 | 0.0040 | 2026-08-06 | AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawl | |
CVE-2026-71447 |
medium | 6.9 | 0.0040 | 2026-08-06 | AIL Project contains a stored cross-site scripting vulnerability in the translation controls display | |
CVE-2026-75529 |
medium | 6.9 | 0.0044 | 2026-08-17 | Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality | |
CVE-2026-52873 |
medium | 6.9 | 0.0036 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. From versi | |
CVE-2026-104073 |
medium | 6.9 | 0.0037 | 2026-10-06 | NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allow | |
CVE-2026-109266 |
medium | 6.9 | 0.0030 | 2026-10-12 | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the | |
CVE-2026-107098 |
medium | 6.8 | 0.0032 | 2026-10-28 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of | |
CVE-2026-110506 |
medium | 6.8 | 0.0032 | 2026-10-28 | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget p | |
CVE-2026-110524 |
medium | 6.8 | 0.0032 | 2026-10-28 | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and es | |
CVE-2026-111967 |
medium | 6.8 | 0.0032 | 2026-10-28 | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode | |
CVE-2026-113487 |
medium | 6.8 | 0.0032 | 2026-10-28 | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge | |
CVE-2026-113488 |
medium | 6.8 | 0.0032 | 2026-10-28 | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode at | |
CVE-2025-40834 |
medium | 6.8 | 0.0025 | 2025-11-17 | A vulnerability has been identified in Mendix RichText (All versions >= V4.0.0 < V4.6.1). Affected w | |
CVE-2026-40284 |
medium | 6.8 | 0.0023 | 2026-04-17 | WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site | |
CVE-2026-41239 |
medium | 6.8 | 0.0025 | 2026-04-23 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in versio | |
CVE-2026-45025 |
medium | 6.8 | 0.0029 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site | |
CVE-2026-45026 |
medium | 6.8 | 0.0029 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site | |
CVE-2026-54303 |
medium | 6.8 | 0.0023 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Mic | |
CVE-2026-67352 |
medium | 6.8 | 0.0041 | 2026-08-01 | luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url pa | |
CVE-2026-15253 |
medium | 6.8 | 0.0043 | 2026-08-19 | The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment tit | |
CVE-2026-18202 |
medium | 6.8 | 0.0043 | 2026-08-19 | The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types | |
CVE-2026-111971 |
medium | 6.8 | 0.0031 | 2026-10-22 | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and e | |
CVE-2026-78392 |
medium | 6.8 | 0.0034 | 2026-10-22 | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outp | |
CVE-2026-109933 |
medium | 6.8 | 0.0031 | 2026-10-23 | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied | |
CVE-2026-111966 |
medium | 6.8 | 0.0031 | 2026-10-23 | The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shor | |
CVE-2026-94264 |
medium | 6.8 | 0.0031 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extend |