Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (848)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-50701 |
medium | 5.1 | 0.0045 | 2026-06-24 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev d | |
CVE-2026-57958 |
medium | 5.1 | 0.0021 | 2026-06-29 | Mixpost through 2.6.0 contains a reflected cross-site scripting vulnerability that allows unauthenti | |
CVE-2026-54889 |
medium | 5.1 | 0.0039 | 2026-06-29 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex al | |
CVE-2026-56809 |
medium | 5.1 | 0.0034 | 2026-06-30 | Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor co | |
CVE-2026-6953 |
medium | 5.1 | 0.0044 | 2026-06-30 | HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an att | |
CVE-2026-6954 |
medium | 5.1 | 0.0044 | 2026-06-30 | Cross-Site Scripting (XSS) vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability a | |
CVE-2026-58579 |
medium | 5.1 | 0.0030 | 2026-07-02 | RAGFlow before 0.26.3 stores an agent pipeline (DSL) node name without sanitization: the agent updat | |
CVE-2026-50133 |
medium | 5.1 | 0.0033 | 2026-07-06 | Hugo is a static site generator. Prior to 0.162.0, Hugo accepts content files in several markup form | |
CVE-2026-58402 |
medium | 5.1 | 0.0030 | 2026-07-06 | Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote | |
CVE-2026-60120 |
medium | 5.1 | 0.0036 | 2026-07-09 | Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template i | |
CVE-2026-41877 |
medium | 5.1 | 0.0039 | 2026-07-10 | R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inje | |
CVE-2026-61456 |
medium | 5.1 | 0.0017 | 2026-07-10 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 fails to sanitize SVG files uploaded thro | |
CVE-2026-15493 |
medium | 5.1 | 0.0033 | 2026-07-12 | A vulnerability was detected in Akpali9 Attendance-Management-System up to 70b91fe38f4195b701a45f0ed | |
CVE-2026-61504 |
medium | 5.1 | 0.0024 | 2026-07-13 | Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and | |
CVE-2026-58228 |
medium | 5.1 | 0.0047 | 2026-07-13 | Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypas | |
CVE-2026-47730 |
medium | 5.1 | 0.0029 | 2026-07-14 | Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes | |
CVE-2026-63081 |
medium | 5.1 | 0.0017 | 2026-07-16 | Perfect Support Ticketing & Document Management System through 1.7 contains a stored cross-site scri | |
CVE-2026-49216 |
medium | 5.1 | 0.0031 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, the Stimulus co | |
CVE-2026-60029 |
medium | 5.1 | 0.0042 | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joom | |
CVE-2026-64628 |
medium | 5.1 | 0.0018 | 2026-07-21 | Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where | |
CVE-2026-65898 |
medium | 5.1 | 0.0021 | 2026-07-23 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an u | |
CVE-2026-65900 |
medium | 5.1 | 0.0031 | 2026-07-23 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a | |
CVE-2026-65901 |
medium | 5.1 | 0.0029 | 2026-07-23 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts a | |
CVE-2026-65911 |
medium | 5.1 | 0.0033 | 2026-07-23 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanit | |
CVE-2026-65912 |
medium | 5.1 | 0.0030 | 2026-07-23 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a | |
CVE-2026-48530 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification | |
CVE-2026-48531 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Poli | |
CVE-2026-48532 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History R | |
CVE-2026-48534 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server co | |
CVE-2026-48535 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home prox | |
CVE-2026-48536 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settin | |
CVE-2026-48537 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive A | |
CVE-2026-48538 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import | |
CVE-2026-48539 |
medium | 5.1 | 0.0024 | 2026-07-23 | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights s | |
CVE-2026-65697 |
medium | 5.1 | 0.0027 | 2026-07-23 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics coll | |
CVE-2026-65762 |
medium | 5.1 | 0.0044 | 2026-07-23 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper | |
CVE-2026-65763 |
medium | 5.1 | 0.0044 | 2026-07-23 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper valid | |
CVE-2026-66010 |
medium | 5.1 | 0.0022 | 2026-07-24 | DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via | |
CVE-2026-65764 |
medium | 5.1 | 0.0044 | 2026-07-27 | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper | |
CVE-2026-66029 |
medium | 5.1 | 0.0029 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability | |
CVE-2026-66030 |
medium | 5.1 | 0.0029 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerabilit | |
CVE-2026-66031 |
medium | 5.1 | 0.0029 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability | |
CVE-2026-59729 |
medium | 5.1 | 0.0047 | 2026-07-27 | Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS | |
CVE-2026-46594 |
medium | 5.1 | 0.0055 | 2026-07-31 | A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Po | |
CVE-2026-68583 |
medium | 5.1 | 0.0024 | 2026-08-02 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blo | |
CVE-2026-66296 |
medium | 5.1 | 0.0037 | 2026-08-03 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows | |
CVE-2026-49131 |
medium | 5.1 | 0.0029 | 2026-08-03 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticate | |
CVE-2026-49132 |
medium | 5.1 | 0.0019 | 2026-08-03 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticate | |
CVE-2026-67196 |
medium | 5.1 | 0.0026 | 2026-08-04 | Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that al | |
CVE-2026-71502 |
medium | 5.1 | 0.0074 | 2026-08-08 | CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutraliza |