Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1856)
CWE-416 (1301)
CWE-862 (1191)
CWE-89 (1107)
CWE-22 (1028)
CWE-125 (885)
CWE-200 (849)
CWE-306 (840)
CWE-122 (831)
CWE-20 (798)
CWE-78 (716)
CWE-787 (693)
CWE-918 (693)
CWE-863 (648)
CWE-94 (642)
CWE-74 (601)
CWE-639 (547)
CWE-400 (532)
CWE-119 (503)
CWE-269 (502)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (375)
CWE-190 (372)
CWE-362 (323)
CWE-352 (283)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-68758 |
medium | 6.5 | 0.0035 | 2026-08-12 | A low-privileged authenticated user may access restricted support information under specific conditi | |
CVE-2026-68971 |
medium | 6.5 | 0.0033 | 2026-08-12 | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and t | |
CVE-2026-27999 |
medium | 6.5 | 0.0034 | 2026-08-13 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | |
CVE-2026-28159 |
medium | 6.5 | 0.0037 | 2026-08-13 | Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. | |
CVE-2026-28181 |
medium | 6.5 | 0.0034 | 2026-08-13 | Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. | |
CVE-2026-61978 |
medium | 6.5 | 0.0033 | 2026-08-13 | Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1. | |
CVE-2026-66464 |
medium | 6.5 | 0.0027 | 2026-08-13 | Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | |
CVE-2026-66660 |
medium | 6.5 | 0.0033 | 2026-08-13 | Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | |
CVE-2026-66693 |
medium | 6.5 | 0.0030 | 2026-08-13 | Subscriber Broken Access Control in Motors <= 1.4.113 versions. | |
CVE-2026-75049 |
medium | 6.5 | 0.0034 | 2026-08-17 | In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted | |
CVE-2026-73424 |
medium | 6.5 | 0.0038 | 2026-08-17 | Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel ada | |
CVE-2026-63669 |
medium | 6.5 | 0.0031 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module' | |
CVE-2026-73348 |
medium | 6.5 | 0.0027 | 2026-08-18 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | |
CVE-2026-73352 |
medium | 6.5 | 0.0027 | 2026-08-18 | Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. | |
CVE-2026-73404 |
medium | 6.5 | 0.0034 | 2026-08-18 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions. | |
CVE-2026-71317 |
medium | 6.5 | 0.0010 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did | |
CVE-2026-12631 |
medium | 6.5 | 0.0015 | 2026-08-18 | The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscal | |
CVE-2026-76257 |
medium | 6.5 | 0.0034 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway ve | |
CVE-2026-54624 |
medium | 6.5 | 0.0042 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-63003 |
medium | 6.5 | 0.0042 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-86332 |
medium | 6.5 | 0.0042 | 2026-09-07 | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/n | |
CVE-2026-106489 |
medium | 6.5 | 0.0029 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin | |
CVE-2026-113649 |
medium | 6.5 | 0.0030 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-expo | |
CVE-2026-114475 |
medium | 6.5 | 0.0024 | 2026-10-21 | Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 thro | |
CVE-2026-76292 |
medium | 6.5 | 0.0034 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway v | |
CVE-2026-76308 |
medium | 6.5 | 0.0017 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edit | |
CVE-2026-87943 |
medium | 6.5 | 0.0025 | 2026-10-22 | Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. | |
CVE-2026-96380 |
medium | 6.5 | 0.0022 | 2026-10-22 | Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issu | |
CVE-2026-96386 |
medium | 6.5 | 0.0022 | 2026-10-22 | Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. This issue aff | |
CVE-2026-112842 |
medium | 6.5 | 0.0021 | 2026-10-22 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscription | |
CVE-2026-114515 |
medium | 6.5 | 0.0027 | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, software deploym | |
CVE-2026-112821 |
medium | 6.5 | 0.0021 | 2026-10-23 | Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Conf | |
CVE-2026-112825 |
medium | 6.5 | 0.0027 | 2026-10-23 | Missing Authorization vulnerability in Magepeople inc. Car Rental Manager car-rental-manager allows | |
CVE-2026-55463 |
medium | 6.5 | 0.0014 | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browse | |
CVE-2026-107907 |
medium | 6.5 | 0.0023 | 2026-10-24 | The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check whe | |
CVE-2026-110892 |
medium | 6.5 | 0.0030 | 2026-10-24 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrec | |
CVE-2026-114705 |
medium | 6.5 | 0.0022 | 2026-10-24 | Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploi | |
CVE-2026-114192 |
medium | 6.5 | 0.0022 | 2026-10-24 | Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting I | |
CVE-2026-115949 |
medium | 6.5 | 0.0027 | 2026-10-26 | Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor b | |
CVE-2026-115195 |
medium | 6.5 | 0.0034 | 2026-10-26 | A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpo | |
CVE-2026-39735 |
medium | 6.5 | — | 2026-10-29 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly | |
CVE-2026-42703 |
medium | 6.5 | — | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly | |
CVE-2026-100404 |
medium | 6.5 | 0.0042 | 2026-10-14 | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users | |
CVE-2025-12523 |
medium | 6.5 | — | 2026-10-29 | Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to a | |
CVE-2026-118760 |
medium | 6.5 | — | 2026-10-29 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. | |
CVE-2026-39594 |
medium | 6.4 | 0.0029 | 2026-06-15 | Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions. | |
CVE-2026-112778 |
medium | 6.4 | 0.0020 | 2026-10-19 | Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Servi | |
CVE-2026-109891 |
medium | 6.4 | — | 2026-10-29 | Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allo | |
CVE-2026-18795 |
medium | 6.4 | 0.0015 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-4309 |
medium | 6.3 | 0.0014 | 2026-03-27 | Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a s |