Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2640)
CWE-79 (1896)
CWE-416 (1380)
CWE-862 (1224)
CWE-89 (1114)
CWE-22 (1036)
CWE-125 (934)
CWE-306 (859)
CWE-200 (856)
CWE-122 (832)
CWE-20 (803)
CWE-787 (730)
CWE-78 (723)
CWE-918 (699)
CWE-863 (659)
CWE-94 (649)
CWE-74 (604)
CWE-639 (570)
CWE-400 (535)
CWE-269 (506)
CWE-119 (504)
CWE-502 (478)
CWE-770 (449)
CWE-287 (443)
CWE-121 (411)
CWE-190 (380)
CWE-77 (375)
CWE-362 (374)
CWE-476 (305)
CWE-352 (288)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-54714 |
medium | 6.1 | 0.0034 | 2026-07-10 | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/c | |
CVE-2026-10770 |
medium | 6.1 | 0.0026 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-13231 |
medium | 6.1 | 0.0025 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-13234 |
medium | 6.1 | 0.0025 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-58587 |
medium | 6.1 | 0.0026 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-58588 |
medium | 6.1 | 0.0026 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-44759 |
medium | 6.1 | 0.0029 | 2026-07-14 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into | |
CVE-2026-44767 |
medium | 6.1 | 0.0029 | 2026-07-14 | setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled abs | |
CVE-2026-23573 |
medium | 6.1 | 0.0039 | 2026-07-14 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilit | |
CVE-2026-49458 |
medium | 6.1 | 0.0040 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DO | |
CVE-2026-49459 |
medium | 6.1 | 0.0037 | 2026-07-14 | DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DO | |
CVE-2026-41580 |
medium | 6.1 | 0.0027 | 2026-07-15 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. P | |
CVE-2026-50182 |
medium | 6.1 | 0.0022 | 2026-07-15 | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Refl | |
CVE-2026-44227 |
medium | 6.1 | 0.0026 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, p | |
CVE-2026-44230 |
medium | 6.1 | 0.0015 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to (but n | |
CVE-2026-51025 |
medium | 6.1 | 0.0025 | 2026-07-20 | Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker | |
CVE-2026-65756 |
medium | 6.1 | 0.0025 | 2026-07-23 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configura | |
CVE-2026-64810 |
medium | 6.1 | 0.0025 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowin | |
CVE-2026-8308 |
medium | 6.1 | 0.0025 | 2026-07-24 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-66390 |
medium | 6.1 | 0.0057 | 2026-07-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-53667 |
medium | 6.1 | 0.0036 | 2026-07-27 | React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missin | |
CVE-2026-8167 |
medium | 6.1 | 0.0025 | 2026-07-28 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-65882 |
medium | 6.1 | 0.0025 | 2026-07-28 | Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url param | |
CVE-2026-14515 |
medium | 6.1 | 0.0030 | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a | |
CVE-2026-65946 |
medium | 6.1 | 0.0025 | 2026-07-29 | Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0 | |
CVE-2026-66490 |
medium | 6.1 | 0.0027 | 2026-07-29 | Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20. | |
CVE-2026-17797 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17818 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote att | |
CVE-2026-17827 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17845 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17853 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17878 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacke | |
CVE-2026-17962 |
medium | 6.1 | 0.0022 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attac | |
CVE-2026-61526 |
medium | 6.1 | 0.0034 | 2026-07-30 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions | |
CVE-2026-10032 |
medium | 6.1 | 0.0013 | 2026-08-04 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() with | |
CVE-2026-71435 |
medium | 6.1 | 0.0034 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, t | |
CVE-2026-71478 |
medium | 6.1 | 0.0036 | 2026-08-06 | league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2 | |
CVE-2026-66771 |
medium | 6.1 | 0.0038 | 2026-08-11 | SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into | |
CVE-2026-66146 |
medium | 6.1 | 0.0030 | 2026-08-11 | Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) a | |
CVE-2026-19657 |
medium | 6.1 | 0.0028 | 2026-08-12 | ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthe | |
CVE-2026-50771 |
medium | 6.1 | 0.0031 | 2026-08-17 | Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to | |
CVE-2026-63670 |
medium | 6.1 | 0.0033 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() c | |
CVE-2025-63607 |
medium | 6.1 | 0.0026 | 2026-08-31 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoe | |
CVE-2026-77490 |
medium | 6.1 | 0.0041 | 2026-09-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ed | |
CVE-2026-91152 |
medium | 6.1 | 0.0035 | 2026-10-29 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin fo | |
CVE-2025-70515 |
medium | 6.1 | 0.0029 | 2026-10-07 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or enc | |
CVE-2025-70519 |
medium | 6.1 | 0.0023 | 2026-10-07 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or enc | |
CVE-2025-27895 |
medium | 6.1 | 0.0016 | 2026-10-12 | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. | |
CVE-2025-27896 |
medium | 6.1 | 0.0016 | 2026-10-12 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. | |
CVE-2025-27897 |
medium | 6.1 | 0.0016 | 2026-10-12 | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. |