Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2641)
CWE-79 (1913)
CWE-416 (1381)
CWE-862 (1237)
CWE-89 (1115)
CWE-22 (1039)
CWE-125 (936)
CWE-306 (860)
CWE-200 (858)
CWE-122 (833)
CWE-20 (804)
CWE-787 (732)
CWE-78 (723)
CWE-918 (701)
CWE-863 (661)
CWE-94 (650)
CWE-74 (604)
CWE-639 (573)
CWE-400 (540)
CWE-269 (507)
CWE-119 (504)
CWE-502 (485)
CWE-770 (450)
CWE-287 (446)
CWE-121 (412)
CWE-190 (381)
CWE-362 (375)
CWE-77 (375)
CWE-476 (308)
CWE-352 (288)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-33406 |
medium | 6.1 | 0.0025 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-39335 |
medium | 6.1 | 0.0025 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group r | |
CVE-2026-39336 |
medium | 6.1 | 0.0021 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting | |
CVE-2026-5301 |
medium | 6.1 | 0.0028 | 2026-04-08 | Stored XSS in log viewer in CoolerControl/coolercontrol-ui <4.0.0 allows unauthenticated attackers t | |
CVE-2026-40112 |
medium | 6.1 | 0.0022 | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the Flask API endpoint in src/praisonai/a | |
CVE-2026-1116 |
medium | 6.1 | 0.0026 | 2026-04-12 | A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollm | |
CVE-2026-0512 |
medium | 6.1 | 0.0023 | 2026-04-14 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management (SICF | |
CVE-2026-21331 |
medium | 6.1 | 0.0028 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (X | |
CVE-2026-32196 |
medium | 6.1 | 0.0029 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admi | |
CVE-2026-20059 |
medium | 6.1 | 0.0019 | 2026-04-15 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unaut | |
CVE-2026-40186 |
medium | 6.1 | 0.0025 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. A regression introduced in commit | |
CVE-2026-33436 |
medium | 6.1 | 0.0017 | 2026-04-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. I | |
CVE-2026-40302 |
medium | 6.1 | 0.0021 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the | |
CVE-2026-31013 |
medium | 6.1 | 0.0019 | 2026-04-21 | Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability i | |
CVE-2026-41067 |
medium | 6.1 | 0.0019 | 2026-04-24 | Astro is a web framework. Prior to 6.1.6, the defineScriptVars function in Astro's server-side rende | |
CVE-2025-56535 |
medium | 6.1 | 0.0019 | 2026-04-29 | A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbit | |
CVE-2025-56536 |
medium | 6.1 | 0.0019 | 2026-04-29 | A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execut | |
CVE-2026-42366 |
medium | 6.1 | 0.0021 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi f | |
CVE-2026-7371 |
medium | 6.1 | 0.0021 | 2026-05-04 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the Web Interface / ssi.cgi f | |
CVE-2026-42509 |
medium | 6.1 | 0.0036 | 2026-05-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-39823 |
medium | 6.1 | 0.0031 | 2026-05-07 | CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag | |
CVE-2026-32207 |
medium | 6.1 | 0.0058 | 2026-05-07 | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machin | |
CVE-2025-65417 |
medium | 6.1 | 0.0024 | 2026-05-11 | docuFORM Managed Print Service Client 11.11c is vulnerable to a reflected cross site scripting attac | |
CVE-2026-42872 |
medium | 6.1 | 0.0021 | 2026-05-11 | WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Si | |
CVE-2026-43878 |
medium | 6.1 | 0.0025 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/ifra | |
CVE-2026-27682 |
medium | 6.1 | 0.0022 | 2026-05-12 | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP | |
CVE-2026-40137 |
medium | 6.1 | 0.0021 | 2026-05-12 | SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicio | |
CVE-2026-44580 |
medium | 6.1 | 0.0021 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 | |
CVE-2026-42897 |
medium | 6.1 | 0.7066 | 2026-05-14 | Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation i | KEV |
CVE-2026-44366 |
medium | 6.1 | 0.0028 | 2026-05-15 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor | |
CVE-2026-46642 |
medium | 6.1 | 0.0022 | 2026-06-10 | draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.12, a cra | |
CVE-2026-48157 |
medium | 6.1 | 0.0017 | 2026-06-15 | Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versi | |
CVE-2026-12459 |
medium | 6.1 | 0.0018 | 2026-06-17 | Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote att | |
CVE-2026-44587 |
medium | 6.1 | 0.0022 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3. | |
CVE-2026-44644 |
medium | 6.1 | 0.0025 | 2026-06-17 | LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 1 | |
CVE-2026-54298 |
medium | 6.1 | 0.0023 | 2026-06-22 | Astro is a web framework. Prior to 6.4.6, the spreadAttributes function in Astro's server-side rende | |
CVE-2026-44311 |
medium | 6.1 | 0.0027 | 2026-06-22 | Fabric.js is a Javascript HTML5 canvas library. Prior to 7.4.0, a potential Cross-Site Scripting (XS | |
CVE-2026-10857 |
medium | 6.1 | 0.0025 | 2026-06-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-34915 |
medium | 6.1 | 0.0026 | 2026-06-23 | A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear | |
CVE-2026-48942 |
medium | 6.1 | 0.0025 | 2026-06-25 | K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinc | |
CVE-2026-50745 |
medium | 6.1 | 0.0038 | 2026-06-26 | A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way U | |
CVE-2026-57326 |
medium | 6.1 | 0.0025 | 2026-06-29 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.22 versions. | |
CVE-2026-8403 |
medium | 6.1 | 0.0025 | 2026-06-30 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-11594 |
medium | 6.1 | 0.0034 | 2026-06-30 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in | |
CVE-2026-13836 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14000 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14001 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote att | |
CVE-2026-14068 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a rem | |
CVE-2026-14145 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke | |
CVE-2026-14147 |
medium | 6.1 | 0.0022 | 2026-06-30 | Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacke |