Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2636)
CWE-79 (1858)
CWE-416 (1301)
CWE-862 (1192)
CWE-89 (1108)
CWE-22 (1029)
CWE-125 (885)
CWE-200 (849)
CWE-306 (840)
CWE-122 (831)
CWE-20 (799)
CWE-78 (716)
CWE-918 (694)
CWE-787 (693)
CWE-863 (648)
CWE-94 (642)
CWE-74 (601)
CWE-639 (548)
CWE-400 (532)
CWE-119 (503)
CWE-269 (502)
CWE-502 (472)
CWE-770 (445)
CWE-287 (433)
CWE-121 (408)
CWE-77 (375)
CWE-190 (372)
CWE-362 (323)
CWE-352 (284)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-57353 |
medium | 6.5 | 0.0030 | 2026-07-02 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. | |
CVE-2026-57355 |
medium | 6.5 | 0.0030 | 2026-07-02 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. | |
CVE-2026-57669 |
medium | 6.5 | 0.0034 | 2026-07-02 | Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions. | |
CVE-2026-57731 |
medium | 6.5 | 0.0034 | 2026-07-02 | Contributor Broken Access Control in Flatsome <= 3.20.5 versions. | |
CVE-2026-34050 |
medium | 6.5 | 0.0038 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-54695 |
medium | 6.5 | 0.0056 | 2026-07-09 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa | |
CVE-2026-59853 |
medium | 6.5 | 0.0030 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getC | |
CVE-2026-13239 |
medium | 6.5 | 0.0027 | 2026-07-10 | Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects Wi | |
CVE-2026-13240 |
medium | 6.5 | 0.0027 | 2026-07-10 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affect | |
CVE-2026-13241 |
medium | 6.5 | 0.0027 | 2026-07-10 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affect | |
CVE-2026-57375 |
medium | 6.5 | 0.0027 | 2026-07-13 | Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrect | |
CVE-2026-57377 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly | |
CVE-2026-57390 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce addi | |
CVE-2026-57392 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Config | |
CVE-2026-57395 |
medium | 6.5 | 0.0034 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Config | |
CVE-2026-57400 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets | |
CVE-2026-57404 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental- | |
CVE-2026-57406 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting I | |
CVE-2026-57408 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gatewa | |
CVE-2026-57412 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Inc | |
CVE-2026-57418 |
medium | 6.5 | 0.0034 | 2026-07-13 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices | |
CVE-2026-57419 |
medium | 6.5 | 0.0030 | 2026-07-13 | Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations | |
CVE-2026-57424 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerc | |
CVE-2026-57812 |
medium | 6.5 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appoint | |
CVE-2026-59523 |
medium | 6.5 | 0.0027 | 2026-07-13 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appoint | |
CVE-2026-58408 |
medium | 6.5 | 0.0036 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user | |
CVE-2026-55440 |
medium | 6.5 | 0.0072 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t | |
CVE-2026-45295 |
medium | 6.5 | 0.0024 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version | |
CVE-2026-6792 |
medium | 6.5 | 0.0034 | 2026-07-21 | Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectl | |
CVE-2026-47411 |
medium | 6.5 | 0.0034 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-60712 |
medium | 6.5 | 0.0015 | 2026-07-21 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C | |
CVE-2026-16544 |
medium | 6.5 | 0.0039 | 2026-07-22 | A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for ev | |
CVE-2026-57425 |
medium | 6.5 | 0.0033 | 2026-07-23 | Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions. | |
CVE-2026-57717 |
medium | 6.5 | 0.0033 | 2026-07-23 | Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. | |
CVE-2026-57808 |
medium | 6.5 | 0.0030 | 2026-07-23 | Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions. | |
CVE-2026-59522 |
medium | 6.5 | 0.0034 | 2026-07-23 | Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. | |
CVE-2026-65499 |
medium | 6.5 | 0.0027 | 2026-07-23 | Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. | |
CVE-2026-47755 |
medium | 6.5 | 0.0035 | 2026-07-23 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service provi | |
CVE-2026-49326 |
medium | 6.5 | 0.0049 | 2026-07-24 | Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan oper | |
CVE-2026-59557 |
medium | 6.5 | 0.0033 | 2026-07-27 | Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. | |
CVE-2026-59560 |
medium | 6.5 | 0.0037 | 2026-07-27 | Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. | |
CVE-2026-65433 |
medium | 6.5 | 0.0030 | 2026-07-27 | Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg < | |
CVE-2026-65435 |
medium | 6.5 | 0.0033 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. | |
CVE-2026-65445 |
medium | 6.5 | 0.0033 | 2026-07-27 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. | |
CVE-2026-70439 |
medium | 6.5 | 0.0027 | 2026-08-05 | Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing at | |
CVE-2026-66452 |
medium | 6.5 | 0.0033 | 2026-08-06 | Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 vers | |
CVE-2026-48075 |
medium | 6.5 | 0.0042 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-64662 |
medium | 6.5 | 0.0042 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, a | |
CVE-2026-18652 |
medium | 6.5 | 0.0034 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design st | |
CVE-2026-68754 |
medium | 6.5 | 0.0031 | 2026-08-12 | A repository publisher without delete permission may modify protected package content under specific |