Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40872 |
critical | 9.3 | 0.0036 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-40873 |
high | 8.9 | 0.0042 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-59855 |
high | 8.6 | 0.0039 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/s | |
CVE-2026-52854 |
high | 8.6 | 0.0058 | 2026-08-18 | Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded | |
CVE-2026-40875 |
high | 7.0 | 0.0024 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 20 | |
CVE-2026-75872 |
medium | 6.9 | 0.0074 | 2026-08-18 | HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticat | |
CVE-2026-40105 |
medium | 6.5 | 0.0055 | 2026-04-15 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of | |
CVE-2026-48910 |
medium | 6.5 | 0.0056 | 2026-07-30 | A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsi | |
CVE-2026-10511 |
medium | 6.4 | 0.0019 | 2026-10-27 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget | |
CVE-2023-23548 |
medium | 6.1 | 0.0041 | 2023-08-01 | Reflected XSS in business intelligence in Checkmk <2.2.0p8, <2.1.0p32, <2.0.0p38, <=1.6.0p30. | |
CVE-2026-20170 |
medium | 6.1 | 0.0022 | 2026-04-15 | A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed | |
CVE-2026-50146 |
medium | 6.1 | 0.0027 | 2026-06-22 | Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts | |
CVE-2026-50229 |
medium | 6.1 | 0.0409 | 2026-06-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the n | |
CVE-2026-7380 |
medium | 6.1 | 0.0025 | 2026-07-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiy | |
CVE-2026-32822 |
medium | 6.1 | 0.0027 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-73237 |
medium | 6.1 | 0.0079 | 2026-08-12 | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.1 | |
CVE-2026-73238 |
medium | 6.1 | 0.0079 | 2026-08-12 | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1 | |
CVE-2026-54443 |
medium | 5.9 | 0.0029 | 2026-07-15 | Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/com | |
CVE-2026-44839 |
medium | 5.6 | 0.0018 | 2026-05-27 | RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerabi | |
CVE-2026-39941 |
medium | 5.3 | 0.0026 | 2026-04-09 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows at | |
CVE-2026-65841 |
medium | 5.3 | 0.0053 | 2026-07-31 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit | |
CVE-2026-116394 |
medium | 5.3 | 0.0030 | 2026-10-26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magep | |
CVE-2026-25467 |
medium | 5.3 | — | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Theme | |
CVE-2026-48202 |
medium | 5.3 | — | 2026-10-29 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave | |
CVE-2026-39425 |
medium | 5.1 | 0.0018 | 2026-04-14 | MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross | |
CVE-2026-1564 |
medium | 5.1 | 0.0019 | 2026-04-15 | Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a use | |
CVE-2026-57167 |
medium | 5.1 | 0.0047 | 2026-07-10 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered | |
CVE-2026-59838 |
medium | 4.8 | 0.0024 | 2026-07-15 | A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in For | |
CVE-2026-34497 |
medium | 4.8 | 0.0023 | 2026-07-31 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johns | |
CVE-2026-44259 |
medium | 4.6 | 0.0017 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with t | |
CVE-2026-44264 |
medium | 4.3 | 0.0027 | 2026-05-07 | Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in use | |
CVE-2026-41611 |
low | 3.3 | 0.0042 | 2026-05-12 | Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code | |
CVE-2026-112945 |
low | 2.1 | 0.0056 | 2026-10-20 | Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, | |
CVE-2026-57534 |
low | 2.1 | 0.0043 | 2026-06-25 | Malicious HTML content could be injected into the content of a page in the pretix-pages plugin. | |
CVE-2026-75082 |
low | 2.1 | 0.0045 | 2026-08-18 | A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of | |
CVE-2026-12812 |
low | 2.0 | 0.0033 | 2026-06-21 | A security vulnerability has been detected in Radware Cyber Controller up to 10.11.0. This affects a | |
CVE-2026-13314 |
low | 2.0 | 0.0043 | 2026-06-25 | Malicious HTML content could be injected into the content rendered by the pretix-digital plugin. | |
CVE-2018-19943 |
— | — | — | — | A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to | KEV |
CVE-2018-19953 |
— | — | — | — | A cross-site scripting vulnerability affecting QNAP NAS File Station could allow remote attackers to | KEV |