Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2637)
CWE-79 (1880)
CWE-416 (1379)
CWE-862 (1214)
CWE-89 (1112)
CWE-22 (1032)
CWE-125 (931)
CWE-306 (858)
CWE-200 (854)
CWE-122 (832)
CWE-20 (801)
CWE-787 (728)
CWE-78 (721)
CWE-918 (699)
CWE-863 (657)
CWE-94 (647)
CWE-74 (603)
CWE-639 (568)
CWE-400 (535)
CWE-119 (504)
CWE-269 (503)
CWE-502 (477)
CWE-770 (449)
CWE-287 (442)
CWE-121 (410)
CWE-190 (380)
CWE-77 (375)
CWE-362 (374)
CWE-476 (303)
CWE-352 (287)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2025-59593 |
medium | 5.9 | 0.0022 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-21631 |
medium | 5.9 | 0.0022 | 2026-04-01 | Lack of output escaping leads to a XSS vector in the multilingual associations component. | |
CVE-2026-21632 |
medium | 5.9 | 0.0019 | 2026-04-01 | Lack of output escaping for article titles leads to XSS vectors in various locations. | |
CVE-2026-6370 |
medium | 5.9 | 0.0014 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42643 |
medium | 5.9 | 0.0014 | 2026-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-8106 |
medium | 5.9 | 0.0016 | 2026-05-07 | A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management C | |
CVE-2026-56007 |
medium | 5.9 | 0.0014 | 2026-06-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-56009 |
medium | 5.9 | 0.0014 | 2026-06-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-57656 |
medium | 5.9 | 0.0024 | 2026-06-26 | Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions. | |
CVE-2026-57722 |
medium | 5.9 | 0.0024 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-55793 |
medium | 5.9 | 0.0032 | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.22, an author-leve | |
CVE-2026-57762 |
medium | 5.9 | 0.0024 | 2026-07-02 | Author Cross Site Scripting (XSS) in Simple URLs <= 151 versions. | |
CVE-2026-48949 |
medium | 5.9 | 0.0024 | 2026-07-07 | Lack of validation leads to an XSS vulnerability in the MFA management views. | |
CVE-2026-48950 |
medium | 5.9 | 0.0024 | 2026-07-07 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | |
CVE-2026-48951 |
medium | 5.9 | 0.0024 | 2026-07-07 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | |
CVE-2026-48952 |
medium | 5.9 | 0.0024 | 2026-07-07 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | |
CVE-2026-48953 |
medium | 5.9 | 0.0024 | 2026-07-07 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | |
CVE-2026-48954 |
medium | 5.9 | 0.0024 | 2026-07-07 | Improper validation leads to a generic XSS vector in the language override feature. | |
CVE-2026-24628 |
medium | 5.9 | 0.0024 | 2026-07-23 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. | |
CVE-2026-65483 |
medium | 5.9 | 0.0024 | 2026-07-23 | Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions. | |
CVE-2026-65534 |
medium | 5.9 | 0.0024 | 2026-07-23 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. | |
CVE-2026-65538 |
medium | 5.9 | 0.0024 | 2026-07-23 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. | |
CVE-2026-65550 |
medium | 5.9 | 0.0024 | 2026-07-23 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | |
CVE-2026-65563 |
medium | 5.9 | 0.0024 | 2026-07-27 | Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions. | |
CVE-2026-66475 |
medium | 5.9 | 0.0024 | 2026-07-27 | Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Ma | |
CVE-2026-28179 |
medium | 5.9 | 0.0024 | 2026-08-06 | Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions. | |
CVE-2026-66706 |
medium | 5.9 | 0.0024 | 2026-08-06 | Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. | |
CVE-2026-73344 |
medium | 5.9 | 0.0024 | 2026-08-13 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | |
CVE-2026-27365 |
medium | 5.9 | 0.0024 | 2026-08-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-57691 |
medium | 5.8 | 0.0020 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-50571 |
medium | 5.7 | 0.0023 | 2026-10-27 | WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websu | |
CVE-2026-87099 |
medium | 5.7 | 0.0024 | 2026-10-28 | Cross-site scripting (XSS) vulnerability due to improper input validation. The following products ar | |
CVE-2026-35451 |
medium | 5.7 | 0.0031 | 2026-04-21 | Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exi | |
CVE-2026-41250 |
medium | 5.7 | 0.0028 | 2026-05-11 | Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front i | |
CVE-2026-12425 |
medium | 5.7 | 0.0015 | 2026-06-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab | |
CVE-2026-44696 |
medium | 5.7 | 0.0025 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, OpenProject's ri | |
CVE-2026-57213 |
medium | 5.7 | 0.0025 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbi | |
CVE-2026-76303 |
medium | 5.7 | 0.0023 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_apps capability could | |
CVE-2026-55600 |
medium | 5.7 | 0.0030 | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to version 2. | |
CVE-2026-8296 |
medium | 5.6 | 0.0032 | 2026-06-19 | In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-S | |
CVE-2026-115425 |
medium | 5.6 | 0.0029 | 2026-10-26 | Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and ea | |
CVE-2026-9007 |
medium | 5.5 | 0.0044 | 2026-07-15 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-95717 |
medium | 5.5 | 0.0027 | 2026-10-22 | A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AO | |
CVE-2023-0025 |
medium | 5.4 | 0.0034 | 2023-02-14 | SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a ma | |
CVE-2023-0902 |
medium | 5.4 | 0.0269 | 2023-02-18 | A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified | |
CVE-2023-23815 |
medium | 5.4 | 0.0039 | 2023-04-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Alan Jackson Multi-column Ta | |
CVE-2024-11831 |
medium | 5.4 | 0.0112 | 2025-02-10 | A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascr | |
CVE-2025-50363 |
medium | 5.4 | 0.0025 | 2025-11-03 | Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hi | |
CVE-2025-57244 |
medium | 5.4 | 0.0022 | 2025-11-05 | OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user accou | |
CVE-2024-33724 |
medium | 5.4 | 0.0063 | 2026-05-08 | SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to proces |