Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-58275 |
critical | 10.0 | 0.0092 | 2026-07-24 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a netw | |
CVE-2026-65667 |
critical | 10.0 | 0.0080 | 2026-08-06 | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over | |
CVE-2026-34976 |
critical | 10.0 | 0.0207 | 2026-04-06 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin muta | |
CVE-2026-41679 |
critical | 10.0 | 0.3167 | 2026-04-23 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. | |
CVE-2026-2031 |
critical | 10.0 | 0.0053 | 2026-05-15 | An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Applicat | |
CVE-2026-0071 |
critical | 10.0 | 0.0015 | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This | |
CVE-2026-0081 |
critical | 10.0 | 0.0015 | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could | |
CVE-2026-0092 |
critical | 10.0 | 0.0022 | 2026-06-17 | In Package Manager, there is a possible device lock controller bypass due to a missing permission ch | |
CVE-2026-28587 |
critical | 10.0 | 0.0011 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information | |
CVE-2026-28615 |
critical | 10.0 | 0.0012 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions byp | |
CVE-2026-28573 |
critical | 10.0 | 0.0014 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission | |
CVE-2026-66012 |
critical | 10.0 | 0.0076 | 2026-07-25 | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint | |
CVE-2026-48168 |
critical | 10.0 | 0.0150 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Acti | |
CVE-2026-62830 |
critical | 9.9 | 0.0078 | 2026-08-06 | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a | |
CVE-2026-44442 |
critical | 9.9 | 0.0028 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoi | |
CVE-2026-46716 |
critical | 9.9 | 0.0043 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-34048 |
critical | 9.9 | 0.0080 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-54052 |
critical | 9.9 | 0.0039 | 2026-07-15 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, a | |
CVE-2026-47724 |
critical | 9.9 | 0.0048 | 2026-07-23 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v | |
CVE-2026-19656 |
critical | 9.9 | 0.0052 | 2026-08-12 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenti | |
CVE-2026-63300 |
critical | 9.9 | 0.0054 | 2026-08-12 | An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go o | |
CVE-2026-83941 |
critical | 9.9 | 0.0078 | 2026-09-08 | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network | |
CVE-2026-107327 |
critical | 9.9 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitra | 1 PoC |
CVE-2026-57116 |
critical | 9.8 | 0.0042 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's Ag | |
CVE-2026-86397 |
critical | 9.8 | 0.0034 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-4277 |
critical | 9.8 | 0.0046 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add permissio | |
CVE-2026-26083 |
critical | 9.8 | 0.0073 | 2026-05-12 | A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4 | |
CVE-2026-6510 |
critical | 9.8 | 0.0044 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorizat | |
CVE-2026-10768 |
critical | 9.8 | 0.0213 | 2026-07-10 | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issu | |
CVE-2026-53633 |
critical | 9.8 | 0.0090 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vite | |
CVE-2026-16184 |
critical | 9.8 | 0.0047 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication | |
CVE-2026-28005 |
critical | 9.8 | 0.0048 | 2026-08-06 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions. | |
CVE-2026-48085 |
critical | 9.8 | 0.0059 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-49819 |
critical | 9.8 | 0.0108 | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentica | |
CVE-2026-57169 |
critical | 9.6 | 0.0030 | 2026-10-16 | Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endp | |
CVE-2026-103799 |
critical | 9.6 | 0.0034 | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS20 | |
CVE-2026-44482 |
critical | 9.6 | 0.0034 | 2026-05-14 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock sup | |
CVE-2026-48582 |
critical | 9.6 | 0.0069 | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileg | |
CVE-2026-12411 |
critical | 9.6 | 0.0029 | 2026-06-26 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust | |
CVE-2026-57498 |
critical | 9.6 | 0.0032 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-55518 |
critical | 9.6 | 0.0041 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, | |
CVE-2026-47413 |
critical | 9.6 | 0.0026 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-47416 |
critical | 9.6 | 0.0026 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-90465 |
critical | 9.4 | 0.0024 | 2026-10-27 | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positio | |
CVE-2026-42809 |
critical | 9.4 | 0.0036 | 2026-05-04 | Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation | |
CVE-2026-42613 |
critical | 9.4 | 0.0114 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in the Login | |
CVE-2026-44592 |
critical | 9.4 | 0.0016 | 2026-05-14 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (th | |
CVE-2026-4764 |
critical | 9.4 | 0.0021 | 2026-06-11 | A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Googl | |
CVE-2026-48088 |
critical | 9.4 | 0.0038 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-73296 |
critical | 9.4 | 0.0365 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t |