Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-56354 |
medium | 5.1 | 0.0024 | 2026-07-10 | n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contains cross-site script | |
CVE-2026-56356 |
medium | 5.1 | 0.0025 | 2026-06-30 | n8n contains a stored cross-site scripting vulnerability in the Chat Trigger node's Custom CSS field | |
CVE-2026-56358 |
medium | 5.1 | 0.0024 | 2026-06-24 | n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in 2.12.0, contains a | |
CVE-2016-20084 |
medium | 5.1 | 0.0024 | 2026-06-15 | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities | |
CVE-2025-34253 |
medium | 5.1 | 0.0054 | 2025-10-16 | D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vuln | |
CVE-2026-72832 |
medium | 5.1 | 0.0031 | 2026-08-14 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the S | |
CVE-2026-90931 |
medium | 5.1 | 0.0024 | 2026-09-14 | LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, al | 1 PoC |
CVE-2026-41610 |
medium | 5.0 | 0.0060 | 2026-05-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studi | |
CVE-2026-43979 |
medium | 5.0 | 0.0033 | 2026-05-28 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0 | |
CVE-2026-57439 |
medium | 5.0 | 0.0014 | 2026-07-08 | CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, th | |
CVE-2026-42447 |
medium | 5.0 | 0.0022 | 2026-07-14 | jadx is a Dex to Java decompiler. Prior to 1.5.6, jadx-gui is affected by an HTML injection vulnerab | |
CVE-2026-70588 |
medium | 5.0 | 0.0043 | 2026-08-04 | Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature | |
CVE-2026-118169 |
medium | 4.9 | 0.0019 | 2026-10-28 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to | |
CVE-2026-114570 |
medium | 4.9 | 0.0022 | 2026-10-22 | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, an | |
CVE-2026-109216 |
medium | 4.9 | — | 2026-10-29 | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-S | |
CVE-2026-115535 |
medium | 4.8 | 0.0021 | 2026-10-23 | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d4 | |
CVE-2026-4950 |
medium | 4.8 | 0.0031 | 2026-10-23 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users | |
CVE-2026-116882 |
medium | 4.8 | 0.0015 | 2026-10-27 | Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that | |
CVE-2026-116883 |
medium | 4.8 | 0.0015 | 2026-10-27 | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that | |
CVE-2026-116888 |
medium | 4.8 | 0.0015 | 2026-10-27 | SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that | |
CVE-2013-20009 |
medium | 4.8 | 0.0022 | 2026-10-28 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows aut | |
CVE-2026-113409 |
medium | 4.8 | 0.0020 | 2026-10-29 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings pa | |
CVE-2026-66092 |
medium | 4.8 | 0.0033 | 2026-10-29 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logo | |
CVE-2026-39991 |
medium | 4.8 | 0.0029 | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote | |
CVE-2026-50684 |
medium | 4.8 | 0.0040 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Active Direc | |
CVE-2023-22685 |
medium | 4.8 | 0.0037 | 2023-05-12 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tips and Tricks HQ, Ruhul Amin Cat | |
CVE-2026-20087 |
medium | 4.8 | 0.0018 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-20088 |
medium | 4.8 | 0.0023 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-20089 |
medium | 4.8 | 0.0025 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-20090 |
medium | 4.8 | 0.0025 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, rem | |
CVE-2026-34729 |
medium | 4.8 | 0.0024 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, there is a stored XSS vulner | |
CVE-2026-25932 |
medium | 4.8 | 0.0028 | 2026-04-06 | GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticat | |
CVE-2026-33405 |
medium | 4.8 | 0.0017 | 2026-04-06 | Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tra | |
CVE-2026-35571 |
medium | 4.8 | 0.0018 | 2026-04-07 | Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, Mustache navigation templates | |
CVE-2026-37980 |
medium | 4.8 | 0.0036 | 2026-04-14 | A flaw was found in Keycloak, specifically in the organization selection login page. A remote attack | |
CVE-2026-39812 |
medium | 4.8 | 0.0019 | 2026-04-14 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability | |
CVE-2026-20132 |
medium | 4.8 | 0.0017 | 2026-04-15 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (IS | |
CVE-2026-1711 |
medium | 4.8 | 0.0019 | 2026-04-15 | Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerabil | |
CVE-2026-28263 |
medium | 4.8 | 0.0020 | 2026-04-17 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions | |
CVE-2026-40593 |
medium | 4.8 | 0.0020 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (U | |
CVE-2026-6623 |
medium | 4.8 | 0.0021 | 2026-04-20 | A security flaw has been discovered in BichitroGan ISP Billing Software 2025.3.20. This impacts an u | |
CVE-2026-23752 |
medium | 4.8 | 0.0015 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template grou | |
CVE-2026-23753 |
medium | 4.8 | 0.0015 | 2026-04-20 | GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language mana | |
CVE-2026-4918 |
medium | 4.8 | 0.0014 | 2026-04-23 | IBM Guardium Data Protection 12.1 is vulnerable to stored cross-site scripting. This vulnerability a | |
CVE-2026-4919 |
medium | 4.8 | 0.0019 | 2026-04-23 | IBM Guardium Data Protection 12.1 is vulnerable to cross-site scripting. This vulnerability allows a | |
CVE-2026-40230 |
medium | 4.8 | 0.0018 | 2026-04-29 | Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic | |
CVE-2026-42150 |
medium | 4.8 | 0.0017 | 2026-05-08 | wlc is a Weblate command-line client using Weblate's REST API. Prior to version 2.0.0, the HTML outp | |
CVE-2026-7814 |
medium | 4.8 | 0.0016 | 2026-05-11 | Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer mod | |
CVE-2026-34655 |
medium | 4.8 | 0.0037 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34658 |
medium | 4.8 | 0.0027 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier |