Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-12463 |
medium | 4.7 | 0.0013 | 2026-06-17 | Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a re | |
CVE-2026-44760 |
medium | 4.7 | 0.0023 | 2026-07-14 | Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages frame | |
CVE-2026-54432 |
medium | 4.7 | 0.0021 | 2026-07-14 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The | |
CVE-2026-50183 |
medium | 4.7 | 0.0020 | 2026-07-15 | WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Sc | |
CVE-2026-54163 |
medium | 4.7 | 0.0021 | 2026-07-17 | secure_headers manages application of security headers with many safe defaults. Prior to 7.3.0, secu | |
CVE-2026-71497 |
medium | 4.7 | 0.0030 | 2026-08-06 | jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML par | |
CVE-2026-73490 |
medium | 4.7 | 0.0030 | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, buil | |
CVE-2026-14287 |
medium | 4.7 | 0.0022 | 2026-08-19 | The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an | |
CVE-2026-68921 |
medium | 4.7 | 0.0029 | 2026-08-20 | DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpola | |
CVE-2026-103875 |
medium | 4.7 | 0.0030 | 2026-10-29 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via | |
CVE-2026-110707 |
medium | 4.7 | 0.0030 | 2026-10-29 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plu | |
CVE-2026-116582 |
medium | 4.7 | 0.0019 | 2026-10-26 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.strin | |
CVE-2026-55422 |
medium | 4.6 | 0.0016 | 2026-10-23 | conda-forge is a GitHub organization containing repositories of conda recipes. In commits 85748ad236 | |
CVE-2026-64897 |
medium | 4.6 | 0.0058 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-64902 |
medium | 4.6 | 0.0058 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-64916 |
medium | 4.6 | 0.0058 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55016 |
medium | 4.6 | 0.0058 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55019 |
medium | 4.6 | 0.0058 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55020 |
medium | 4.6 | 0.0058 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55030 |
medium | 4.6 | 0.0058 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-55135 |
medium | 4.6 | 0.0058 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-62826 |
medium | 4.6 | 0.0058 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-62829 |
medium | 4.6 | 0.0047 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-64922 |
medium | 4.6 | 0.0058 | 2026-08-11 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-102859 |
medium | 4.6 | 0.0041 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-102864 |
medium | 4.6 | 0.0041 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-88208 |
medium | 4.6 | 0.0027 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-88209 |
medium | 4.6 | 0.0036 | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of | |
CVE-2026-1493 |
medium | 4.6 | 0.0018 | 2026-04-30 | LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafel | |
CVE-2026-42086 |
medium | 4.6 | 0.0020 | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor | |
CVE-2026-46609 |
medium | 4.6 | 0.0014 | 2026-06-10 | Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are abl | |
CVE-2026-45106 |
medium | 4.6 | 0.0021 | 2026-06-10 | Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview ren | |
CVE-2026-56381 |
medium | 4.6 | 0.0018 | 2026-06-21 | Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Pe | |
CVE-2026-56383 |
medium | 4.6 | 0.0022 | 2026-06-21 | Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig compo | |
CVE-2026-56393 |
medium | 4.6 | 0.0022 | 2026-06-21 | Craft CMS 4.x (>= 4.0.0-RC1, < 4.17.0-beta.1) and 5.x (>= 5.0.0-RC1, < 5.9.0-beta.1) contain multipl | |
CVE-2026-50698 |
medium | 4.6 | 0.0032 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50699 |
medium | 4.6 | 0.0040 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev. An | |
CVE-2026-50700 |
medium | 4.6 | 0.0043 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50704 |
medium | 4.6 | 0.0032 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50705 |
medium | 4.6 | 0.0032 | 2026-06-24 | A Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due to impr | |
CVE-2026-50710 |
medium | 4.6 | 0.0032 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-50711 |
medium | 4.6 | 0.0032 | 2026-06-24 | A Stored Cross-Site Scripting (XSS) vulnerability exists in Frappe Framework version 17.0.0-dev due | |
CVE-2026-4770 |
medium | 4.6 | 0.0023 | 2026-07-02 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i | |
CVE-2026-1562 |
medium | 4.6 | 0.0024 | 2026-07-15 | Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vul | |
CVE-2026-14337 |
medium | 4.6 | 0.0042 | 2026-08-04 | Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vu | |
CVE-2026-73426 |
medium | 4.6 | 0.0032 | 2026-08-18 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix | |
CVE-2026-84915 |
medium | 4.6 | 0.0021 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-84919 |
medium | 4.6 | 0.0021 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-87942 |
medium | 4.6 | 0.0021 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96357 |
medium | 4.6 | 0.0022 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i |