Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2636)
CWE-79 (1862)
CWE-416 (1371)
CWE-862 (1193)
CWE-89 (1108)
CWE-22 (1029)
CWE-125 (919)
CWE-200 (851)
CWE-306 (840)
CWE-122 (832)
CWE-20 (801)
CWE-78 (717)
CWE-787 (714)
CWE-918 (695)
CWE-863 (649)
CWE-94 (642)
CWE-74 (601)
CWE-639 (551)
CWE-400 (535)
CWE-119 (504)
CWE-269 (502)
CWE-502 (472)
CWE-770 (447)
CWE-287 (434)
CWE-121 (409)
CWE-190 (377)
CWE-77 (375)
CWE-362 (373)
CWE-476 (299)
CWE-352 (284)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2025-62037 |
medium | 6.5 | 0.0033 | 2025-11-06 | Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1 | |
CVE-2026-33141 |
medium | 6.5 | 0.0014 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Referenc | |
CVE-2026-33708 |
medium | 6.5 | 0.0021 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST | |
CVE-2026-40185 |
medium | 6.5 | 0.0021 | 2026-04-10 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the | |
CVE-2026-27677 |
medium | 6.5 | 0.0018 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), a | |
CVE-2026-27678 |
medium | 6.5 | 0.0018 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Struc | |
CVE-2026-27679 |
medium | 6.5 | 0.0018 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Stru | |
CVE-2026-34261 |
medium | 6.5 | 0.0021 | 2026-04-14 | Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authen | |
CVE-2026-6706 |
medium | 6.5 | 0.0020 | 2026-04-28 | Improper access control in the vault documentation feature in Devolutions Server allows an authent | |
CVE-2026-42412 |
medium | 6.5 | 0.0019 | 2026-04-29 | Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configu | |
CVE-2026-28380 |
medium | 6.5 | 0.0023 | 2026-05-13 | Any Editor could delete any snapshot, even if they have no access to read or write them. | |
CVE-2026-44448 |
medium | 6.5 | 0.0014 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, | |
CVE-2026-42726 |
medium | 6.5 | 0.0024 | 2026-05-27 | Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds | |
CVE-2026-11852 |
medium | 6.5 | 0.0020 | 2026-06-10 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Fi | |
CVE-2026-50084 |
medium | 6.5 | 0.0024 | 2026-06-12 | The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer | |
CVE-2026-48969 |
medium | 6.5 | 0.0026 | 2026-06-15 | Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions. | |
CVE-2026-39515 |
medium | 6.5 | 0.0035 | 2026-06-15 | Subscriber Broken Access Control in Motors < 1.4.107 versions. | |
CVE-2026-39525 |
medium | 6.5 | 0.0024 | 2026-06-15 | Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions. | |
CVE-2026-39584 |
medium | 6.5 | 0.0033 | 2026-06-15 | Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions. | |
CVE-2026-40743 |
medium | 6.5 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions. | |
CVE-2026-40773 |
medium | 6.5 | 0.0028 | 2026-06-15 | Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions. | |
CVE-2026-40782 |
medium | 6.5 | 0.0024 | 2026-06-15 | Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions. | |
CVE-2026-40793 |
medium | 6.5 | 0.0028 | 2026-06-15 | Subscriber Broken Access Control in Groundhogg < 4.4.1 versions. | |
CVE-2026-40795 |
medium | 6.5 | 0.0027 | 2026-06-15 | Subscriber Broken Access Control in Amelia <= 2.2 versions. | |
CVE-2026-42640 |
medium | 6.5 | 0.0019 | 2026-06-15 | Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions. | |
CVE-2026-42659 |
medium | 6.5 | 0.0027 | 2026-06-15 | Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions. | |
CVE-2026-48887 |
medium | 6.5 | 0.0024 | 2026-06-15 | Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-49775 |
medium | 6.5 | 0.0019 | 2026-06-15 | Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions. | |
CVE-2026-40809 |
medium | 6.5 | 0.0020 | 2026-06-16 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Conf | |
CVE-2026-54190 |
medium | 6.5 | 0.0026 | 2026-06-16 | Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. | |
CVE-2026-12105 |
medium | 6.5 | 0.0030 | 2026-06-16 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to a | |
CVE-2026-39433 |
medium | 6.5 | 0.0035 | 2026-06-17 | Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions. | |
CVE-2026-45436 |
medium | 6.5 | 0.0030 | 2026-06-17 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. | |
CVE-2026-49072 |
medium | 6.5 | 0.0031 | 2026-06-17 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. | |
CVE-2026-49205 |
medium | 6.5 | 0.0039 | 2026-06-18 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization | |
CVE-2026-48500 |
medium | 6.5 | 0.0034 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 un | |
CVE-2026-57429 |
medium | 6.5 | 0.0034 | 2026-06-25 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | |
CVE-2026-57619 |
medium | 6.5 | 0.0037 | 2026-06-25 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. | |
CVE-2026-48941 |
medium | 6.5 | 0.0027 | 2026-06-25 | The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and us | |
CVE-2026-54027 |
medium | 6.5 | 0.0032 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the | |
CVE-2026-54029 |
medium | 6.5 | 0.0027 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the | |
CVE-2026-52701 |
medium | 6.5 | 0.0027 | 2026-06-26 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. | |
CVE-2026-57324 |
medium | 6.5 | 0.0033 | 2026-06-26 | Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. | |
CVE-2026-57654 |
medium | 6.5 | 0.0030 | 2026-06-26 | Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions. | |
CVE-2026-44734 |
medium | 6.5 | 0.0033 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Mis | |
CVE-2026-57334 |
medium | 6.5 | 0.0033 | 2026-06-29 | Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. | |
CVE-2026-57335 |
medium | 6.5 | 0.0030 | 2026-06-29 | Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. | |
CVE-2026-57339 |
medium | 6.5 | 0.0033 | 2026-06-29 | Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions. | |
CVE-2026-57340 |
medium | 6.5 | 0.0033 | 2026-06-29 | Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. | |
CVE-2026-14156 |
medium | 6.5 | 0.0029 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed |