Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1856)
CWE-416 (1301)
CWE-862 (1191)
CWE-89 (1107)
CWE-22 (1028)
CWE-125 (885)
CWE-200 (849)
CWE-306 (840)
CWE-122 (831)
CWE-20 (798)
CWE-78 (716)
CWE-787 (693)
CWE-918 (693)
CWE-863 (648)
CWE-94 (642)
CWE-74 (601)
CWE-639 (547)
CWE-400 (532)
CWE-119 (503)
CWE-269 (502)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (375)
CWE-190 (372)
CWE-362 (323)
CWE-352 (283)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-68585 |
medium | 6.9 | 0.0024 | 2026-08-03 | SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlock | |
CVE-2026-63248 |
medium | 6.9 | 0.0026 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access | |
CVE-2026-54201 |
medium | 6.9 | 0.0057 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks w | |
CVE-2026-71959 |
medium | 6.9 | 0.0048 | 2026-08-10 | Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization ide | |
CVE-2026-72759 |
medium | 6.9 | 0.0048 | 2026-08-10 | In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an inco | |
CVE-2026-72790 |
medium | 6.9 | 0.0032 | 2026-08-12 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebo | |
CVE-2026-72791 |
medium | 6.9 | 0.0032 | 2026-08-12 | SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) conta | |
CVE-2026-72796 |
medium | 6.9 | 0.0035 | 2026-08-12 | SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the | |
CVE-2026-72797 |
medium | 6.9 | 0.0030 | 2026-08-12 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNot | |
CVE-2026-72799 |
medium | 6.9 | 0.0032 | 2026-08-12 | SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree pa | |
CVE-2026-72800 |
medium | 6.9 | 0.0032 | 2026-08-12 | SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID | |
CVE-2026-72803 |
medium | 6.9 | 0.0030 | 2026-08-12 | SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGe | |
CVE-2026-72805 |
medium | 6.9 | 0.0030 | 2026-08-12 | SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefTex | |
CVE-2026-72806 |
medium | 6.9 | 0.0038 | 2026-08-12 | SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPubl | |
CVE-2026-72808 |
medium | 6.9 | 0.0035 | 2026-08-12 | SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulne | |
CVE-2026-73605 |
medium | 6.9 | 0.0032 | 2026-08-13 | SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoi | |
CVE-2026-73607 |
medium | 6.9 | 0.0025 | 2026-08-13 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/ge | |
CVE-2026-73609 |
medium | 6.9 | 0.0032 | 2026-08-13 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabe | |
CVE-2026-67440 |
medium | 6.9 | 0.0054 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the | |
CVE-2026-19755 |
medium | 6.9 | 0.0014 | 2026-08-20 | NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing a | |
CVE-2026-110105 |
medium | 6.9 | 0.0029 | 2026-10-13 | B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthentica | |
CVE-2026-114390 |
medium | 6.9 | 0.0023 | 2026-10-21 | Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in l | |
CVE-2026-115972 |
medium | 6.9 | 0.0028 | 2026-10-24 | A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerabil | |
CVE-2026-33776 |
medium | 6.8 | 0.0009 | 2026-04-09 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved a | |
CVE-2026-53850 |
medium | 6.8 | 0.0009 | 2026-06-16 | OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus com | |
CVE-2026-10609 |
medium | 6.8 | 0.0037 | 2026-06-23 | A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creat | |
CVE-2026-33802 |
medium | 6.8 | 0.0012 | 2026-07-09 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a | |
CVE-2026-7328 |
medium | 6.8 | 0.0013 | 2026-07-22 | Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, | |
CVE-2026-59677 |
medium | 6.8 | 0.0014 | 2026-07-23 | A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is ru | |
CVE-2026-5944 |
medium | 6.7 | 0.0053 | 2026-04-28 | An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix | |
CVE-2026-27377 |
medium | 6.7 | 0.0038 | 2026-07-23 | Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0. | |
CVE-2026-40375 |
medium | 6.5 | 0.0084 | 2026-08-11 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose informa | |
CVE-2026-76305 |
medium | 6.5 | 0.0027 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission | |
CVE-2026-16491 |
medium | 6.5 | 0.0029 | 2026-10-27 | Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder admini | |
CVE-2026-110691 |
medium | 6.5 | 0.0026 | 2026-10-28 | The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce | |
CVE-2026-113813 |
medium | 6.5 | 0.0021 | 2026-10-28 | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability | |
CVE-2026-110020 |
medium | 6.5 | 0.0038 | 2026-10-28 | The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to authorization bypass in a | |
CVE-2026-86390 |
medium | 6.5 | 0.0033 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-116404 |
medium | 6.5 | 0.0020 | 2026-10-28 | Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting | |
CVE-2026-50541 |
medium | 6.5 | 0.0037 | 2026-10-28 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-50539 |
medium | 6.5 | 0.0037 | 2026-10-28 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-105620 |
medium | 6.5 | 0.0020 | 2026-10-28 | PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved i | |
CVE-2026-19610 |
medium | 6.5 | 0.0021 | 2026-10-29 | A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to J | |
CVE-2026-66326 |
medium | 6.5 | 0.0077 | 2026-08-03 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute | |
CVE-2026-58279 |
medium | 6.5 | 0.0064 | 2026-07-14 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a | |
CVE-2026-62915 |
medium | 6.5 | 0.0064 | 2026-08-11 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a securit | |
CVE-2026-65806 |
medium | 6.5 | 0.0084 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over | |
CVE-2026-87714 |
medium | 6.5 | 0.0045 | 2026-10-13 | Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a ne | |
CVE-2025-62033 |
medium | 6.5 | 0.0030 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1 | |
CVE-2025-62037 |
medium | 6.5 | 0.0033 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1 |