Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (848)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-66581 |
high | 7.1 | 0.0025 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. | |
CVE-2026-66590 |
high | 7.1 | 0.0025 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. | |
CVE-2026-102636 |
high | 7.1 | 0.0015 | 2026-10-27 | A maliciously crafted HTML payload in a design name, when displayed after another user opens the man | |
CVE-2026-102637 |
high | 7.1 | 0.0015 | 2026-10-27 | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the | |
CVE-2026-102638 |
high | 7.1 | 0.0015 | 2026-10-27 | A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when dis | |
CVE-2026-111021 |
high | 7.1 | 0.0019 | 2026-10-28 | The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise a | |
CVE-2026-115593 |
high | 7.1 | 0.0019 | 2026-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115596 |
high | 7.1 | 0.0020 | 2026-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115606 |
high | 7.1 | 0.0015 | 2026-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115609 |
high | 7.1 | 0.0015 | 2026-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-115612 |
high | 7.1 | 0.0020 | 2026-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-57101 |
high | 7.1 | 0.0048 | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studi | |
CVE-2026-57977 |
high | 7.1 | 0.0058 | 2026-07-03 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ed | |
CVE-2025-58966 |
high | 7.1 | 0.0024 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-59571 |
high | 7.1 | 0.0025 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-58964 |
high | 7.1 | 0.0023 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-59556 |
high | 7.1 | 0.0023 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-62036 |
high | 7.1 | 0.0023 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-62057 |
high | 7.1 | 0.0024 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-60182 |
high | 7.1 | 0.0022 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-64189 |
high | 7.1 | 0.0022 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2025-64376 |
high | 7.1 | 0.0018 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-4344 |
high | 7.1 | 0.0020 | 2026-04-14 | A maliciously crafted HTML payload in a component name, when displayed during the delete confirmatio | |
CVE-2026-4345 |
high | 7.1 | 0.0020 | 2026-04-14 | A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Store | |
CVE-2026-4369 |
high | 7.1 | 0.0020 | 2026-04-14 | A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete con | |
CVE-2026-42652 |
high | 7.1 | 0.0015 | 2026-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-41554 |
high | 7.1 | 0.0014 | 2026-05-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-41576 |
high | 7.1 | 0.0027 | 2026-05-08 | Brave CMS is an open-source CMS. Prior to commit 6c56603, the contact form is publicly accessible (n | |
CVE-2026-42728 |
high | 7.1 | 0.0018 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42729 |
high | 7.1 | 0.0018 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42733 |
high | 7.1 | 0.0018 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42734 |
high | 7.1 | 0.0018 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42738 |
high | 7.1 | 0.0015 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42739 |
high | 7.1 | 0.0015 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42754 |
high | 7.1 | 0.0020 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42759 |
high | 7.1 | 0.0015 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42762 |
high | 7.1 | 0.0014 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-49069 |
high | 7.1 | 0.0117 | 2026-06-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-42653 |
high | 7.1 | 0.0014 | 2026-06-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i | |
CVE-2026-23970 |
high | 7.1 | 0.0024 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions. | |
CVE-2026-34900 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions. | |
CVE-2026-34902 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions. | |
CVE-2026-39435 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions. | |
CVE-2026-39447 |
high | 7.1 | 0.0024 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions. | |
CVE-2026-39449 |
high | 7.1 | 0.0023 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions. | |
CVE-2026-39463 |
high | 7.1 | 0.0023 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions. | |
CVE-2026-39507 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions. | |
CVE-2026-39514 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions. | |
CVE-2026-40732 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions. | |
CVE-2026-40770 |
high | 7.1 | 0.0018 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions. |