Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2637)
CWE-79 (1869)
CWE-416 (1375)
CWE-862 (1202)
CWE-89 (1111)
CWE-22 (1030)
CWE-125 (922)
CWE-200 (853)
CWE-306 (852)
CWE-122 (832)
CWE-20 (801)
CWE-78 (718)
CWE-787 (716)
CWE-918 (696)
CWE-863 (652)
CWE-94 (642)
CWE-74 (602)
CWE-639 (566)
CWE-400 (535)
CWE-119 (504)
CWE-269 (502)
CWE-502 (473)
CWE-770 (447)
CWE-287 (441)
CWE-121 (410)
CWE-190 (377)
CWE-77 (375)
CWE-362 (373)
CWE-476 (300)
CWE-352 (284)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-13977 |
medium | 5.4 | 0.0022 | 2026-06-30 | Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote | |
CVE-2026-6283 |
medium | 5.4 | 0.0023 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-54720 |
medium | 5.4 | 0.0026 | 2026-07-01 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In versions prior to 6. | |
CVE-2026-4772 |
medium | 5.4 | 0.0023 | 2026-07-02 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-8309 |
medium | 5.4 | 0.0023 | 2026-07-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-36163 |
medium | 5.4 | 0.0017 | 2026-07-07 | An HTML injection vulnerability in the file view endpoint of LiquidFiles v4.2.7 allows authenticated | |
CVE-2026-8315 |
medium | 5.4 | 0.0023 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-11903 |
medium | 5.4 | 0.0041 | 2026-07-08 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-6896 |
medium | 5.4 | 0.0040 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 b | |
CVE-2026-5005 |
medium | 5.4 | 0.0023 | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-59794 |
medium | 5.4 | 0.0032 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-re | |
CVE-2026-8595 |
medium | 5.4 | 0.0024 | 2026-07-10 | A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a maliciou | |
CVE-2026-10769 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-11908 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-15082 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-15084 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-15085 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-55808 |
medium | 5.4 | 0.0027 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-58591 |
medium | 5.4 | 0.0023 | 2026-07-10 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-12228 |
medium | 5.4 | 0.0033 | 2026-07-18 | A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint o | |
CVE-2026-45138 |
medium | 5.4 | 0.0018 | 2026-07-20 | CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the cu | |
CVE-2026-6793 |
medium | 5.4 | 0.0023 | 2026-07-20 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-44228 |
medium | 5.4 | 0.0026 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, p | |
CVE-2026-44229 |
medium | 5.4 | 0.0014 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 an | |
CVE-2026-64795 |
medium | 5.4 | 0.0023 | 2026-07-22 | Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs exte | |
CVE-2026-15968 |
medium | 5.4 | 0.0033 | 2026-07-23 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-17728 |
medium | 5.4 | 0.0022 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote | |
CVE-2026-17734 |
medium | 5.4 | 0.0022 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote at | |
CVE-2026-17903 |
medium | 5.4 | 0.0016 | 2026-07-30 | Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an att | |
CVE-2026-59328 |
medium | 5.4 | 0.0017 | 2026-07-30 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded | |
CVE-2026-11383 |
medium | 5.4 | 0.0023 | 2026-07-30 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte | |
CVE-2026-62324 |
medium | 5.4 | 0.0031 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodi | |
CVE-2026-14192 |
medium | 5.4 | 0.0023 | 2026-08-04 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-71275 |
medium | 5.4 | 0.0023 | 2026-08-05 | OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter dir | |
CVE-2026-70440 |
medium | 5.4 | 0.0023 | 2026-08-05 | Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controll | |
CVE-2026-70441 |
medium | 5.4 | 0.0023 | 2026-08-05 | Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context | |
CVE-2026-8166 |
medium | 5.4 | 0.0023 | 2026-08-06 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-54717 |
medium | 5.4 | 0.0034 | 2026-08-06 | Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in th | |
CVE-2026-72570 |
medium | 5.4 | 0.0024 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows | |
CVE-2026-72576 |
medium | 5.4 | 0.0029 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authe | |
CVE-2026-72583 |
medium | 5.4 | 0.0026 | 2026-08-10 | A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privile | |
CVE-2026-56619 |
medium | 5.4 | 0.0023 | 2026-08-10 | HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficien | |
CVE-2026-72553 |
medium | 5.4 | 0.0023 | 2026-08-11 | A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member | |
CVE-2026-72559 |
medium | 5.4 | 0.0023 | 2026-08-11 | A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members | |
CVE-2026-73262 |
medium | 5.4 | 0.0030 | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/li | |
CVE-2026-16694 |
medium | 5.4 | 0.0023 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows | |
CVE-2026-73295 |
medium | 5.4 | 0.0033 | 2026-08-12 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9 | |
CVE-2026-18099 |
medium | 5.4 | 0.0033 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script | |
CVE-2026-19447 |
medium | 5.4 | 0.0023 | 2026-08-18 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-55491 |
medium | 5.4 | 0.0029 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape m |