Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-96358 |
medium | 4.6 | 0.0022 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96359 |
medium | 4.6 | 0.0022 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96361 |
medium | 4.6 | 0.0022 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96368 |
medium | 4.6 | 0.0017 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96382 |
medium | 4.6 | 0.0017 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-42887 |
medium | 4.5 | 0.0026 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.33.0, a stored cross-site s | |
CVE-2026-109988 |
medium | 4.4 | 0.0021 | 2026-10-28 | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vuln | |
CVE-2026-111068 |
medium | 4.4 | 0.0021 | 2026-10-28 | The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' | |
CVE-2026-0256 |
medium | 4.4 | 0.0016 | 2026-05-13 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a m | |
CVE-2026-47733 |
medium | 4.4 | 0.0014 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, t | |
CVE-2026-75059 |
medium | 4.4 | 0.0018 | 2026-08-17 | In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible | |
CVE-2026-75526 |
medium | 4.4 | 0.0026 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2024-35321 |
medium | 4.3 | 0.0031 | 2025-12-22 | MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (XSS) vulnerability vi | |
CVE-2026-70596 |
medium | 4.3 | 0.0032 | 2026-08-05 | Ghost is a Node.js content management system. From 4.9.0 until 6.54.1, an input validation issue all | |
CVE-2026-13957 |
medium | 4.2 | 0.0016 | 2026-06-30 | Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who | |
CVE-2026-17739 |
medium | 4.2 | 0.0015 | 2026-07-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an att | |
CVE-2026-87939 |
medium | 4.2 | 0.0020 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96362 |
medium | 4.2 | 0.0020 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-27683 |
medium | 4.1 | 0.0019 | 2026-04-14 | SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject mal | |
CVE-2026-55592 |
low | 3.9 | 0.0035 | 2026-07-07 | Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url q | |
CVE-2024-7083 |
low | 3.5 | 0.0021 | 2026-04-20 | The Email Encoder WordPress plugin before 2.3.4 does not sanitise and escape some of its settings, | |
CVE-2026-14325 |
low | 3.5 | 0.0024 | 2026-08-21 | The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not e | |
CVE-2026-87948 |
low | 3.5 | 0.0022 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-96360 |
low | 3.5 | 0.0023 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-111737 |
low | 3.5 | 0.0019 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings | |
CVE-2025-15705 |
low | 3.5 | 0.0014 | 2026-10-25 | The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form nam | |
CVE-2024-3586 |
low | 3.5 | 0.0016 | 2026-10-29 | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, wh | |
CVE-2026-105258 |
low | 3.5 | 0.0017 | 2026-10-29 | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form s | |
CVE-2026-48940 |
low | 3.4 | 0.0028 | 2026-06-25 | A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `emb | |
CVE-2026-41611 |
low | 3.3 | 0.0042 | 2026-05-12 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code | |
CVE-2026-87949 |
low | 3.3 | 0.0021 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-116687 |
low | 3.1 | 0.0025 | 2026-10-27 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7. | |
CVE-2026-27937 |
low | 3.1 | 0.0014 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflect | |
CVE-2026-84911 |
low | 3.1 | 0.0019 | 2026-10-22 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability i | |
CVE-2026-45028 |
low | 2.9 | 0.0014 | 2026-05-13 | Astro is a web framework. Astro versions prior to 6.1.10 used AES-GCM encryption to protect the conf | |
CVE-2026-52838 |
low | 2.6 | 0.0022 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrato | |
CVE-2026-54326 |
low | 2.5 | 0.0017 | 2026-06-23 | Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi HTML exports render session Ma | |
CVE-2026-4313 |
low | 2.4 | 0.0059 | 2026-04-24 | AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacke | |
CVE-2026-114061 |
low | 2.3 | 0.0021 | 2026-10-21 | SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered | |
CVE-2026-114130 |
low | 2.3 | 0.0041 | 2026-10-21 | Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for C | |
CVE-2026-57196 |
low | 2.3 | 0.0077 | 2026-10-26 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-42794 |
low | 2.3 | 0.0028 | 2026-05-08 | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in absinthe-graphql | |
CVE-2026-34089 |
low | 2.3 | 0.0035 | 2026-05-11 | Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1 | |
CVE-2026-53427 |
low | 2.3 | 0.0069 | 2026-06-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-49210 |
low | 2.3 | 0.0034 | 2026-07-17 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, Symfony\UX\Live | |
CVE-2026-66300 |
low | 2.3 | 0.0032 | 2026-08-04 | SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirec | |
CVE-2026-73157 |
low | 2.3 | 0.0044 | 2026-08-11 | Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-b | |
CVE-2026-73492 |
low | 2.3 | 0.0039 | 2026-08-12 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, buil | |
CVE-2026-114127 |
low | 2.3 | 0.0039 | 2026-10-21 | Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side Vi | |
CVE-2026-115754 |
low | 2.3 | 0.0023 | 2026-10-23 | serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allo |