Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1854)
CWE-416 (1298)
CWE-862 (1188)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (849)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-34245 |
medium | 6.3 | 0.0025 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Play | |
CVE-2026-33785 |
medium | 6.3 | 0.0014 | 2026-04-09 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a | |
CVE-2026-40133 |
medium | 6.3 | 0.0022 | 2026-05-12 | Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker c | |
CVE-2026-42651 |
medium | 6.3 | 0.0024 | 2026-06-15 | Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions. | |
CVE-2026-53851 |
medium | 6.3 | 0.0019 | 2026-06-16 | OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction event | |
CVE-2026-57946 |
medium | 6.3 | 0.0035 | 2026-06-29 | Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows una | |
CVE-2026-54004 |
medium | 6.3 | 0.0050 | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with conten | |
CVE-2026-13078 |
medium | 6.3 | 0.0037 | 2026-07-22 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine uncond | |
CVE-2026-57703 |
medium | 6.3 | 0.0026 | 2026-07-23 | Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. | |
CVE-2026-65484 |
medium | 6.3 | 0.0026 | 2026-07-23 | Contributor Broken Access Control in Style Kits <= 2.6.5 versions. | |
CVE-2026-73603 |
medium | 6.3 | 0.0033 | 2026-08-13 | Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech end | |
CVE-2026-66689 |
medium | 6.3 | 0.0026 | 2026-08-13 | Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 vers | |
CVE-2026-47721 |
medium | 6.3 | 0.0043 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/ | |
CVE-2026-115502 |
medium | 6.3 | 0.0028 | 2026-10-22 | A missing authorization check allows anyone having access to a "link without login" for a DataApp to | |
CVE-2026-66311 |
medium | 6.2 | 0.0040 | 2026-08-03 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform | |
CVE-2026-116893 |
medium | 6.1 | 0.0025 | 2026-10-27 | REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API | |
CVE-2026-108301 |
medium | 6.0 | 0.0014 | 2026-10-27 | Tanium addressed an improper access controls vulnerability in Comply. | |
CVE-2026-53844 |
medium | 6.0 | 0.0021 | 2026-06-16 | OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory | |
CVE-2026-57952 |
medium | 6.0 | 0.0029 | 2026-06-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2prof | |
CVE-2026-9132 |
medium | 6.0 | 0.0042 | 2026-06-30 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut | |
CVE-2026-44176 |
medium | 6.0 | 0.0036 | 2026-07-16 | Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check th | |
CVE-2026-62205 |
medium | 6.0 | 0.0036 | 2026-07-17 | OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in | |
CVE-2026-62206 |
medium | 6.0 | 0.0036 | 2026-07-17 | OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderatio | |
CVE-2026-110210 |
medium | 6.0 | 0.0050 | 2026-10-13 | Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation | |
CVE-2026-40265 |
medium | 5.9 | 0.0044 | 2026-04-17 | Note Mark is an open-source note-taking application. In versions 0.19.1 and prior, the asset downloa | |
CVE-2026-0246 |
medium | 5.9 | 0.0015 | 2026-05-13 | A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® | |
CVE-2026-58482 |
medium | 5.9 | 0.0020 | 2026-07-20 | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented featu | |
CVE-2026-68979 |
medium | 5.9 | 0.0081 | 2026-08-03 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not e | |
CVE-2026-58237 |
medium | 5.9 | 0.0028 | 2026-08-11 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality | |
CVE-2026-18709 |
medium | 5.9 | 0.0019 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard t | |
CVE-2026-69107 |
medium | 5.9 | 0.0041 | 2026-08-12 | An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditio | |
CVE-2026-57323 |
medium | 5.8 | 0.0031 | 2026-06-26 | Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions. | |
CVE-2026-105618 |
medium | 5.7 | 0.0018 | 2026-10-28 | PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables | |
CVE-2026-102682 |
medium | 5.6 | 0.0023 | 2026-10-14 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa | |
CVE-2026-70235 |
medium | 5.5 | 0.0032 | 2026-10-13 | Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing l | |
CVE-2026-85938 |
medium | 5.5 | 0.0034 | 2026-10-13 | Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to discl | |
CVE-2026-116623 |
medium | 5.5 | 0.0039 | 2026-10-27 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an u | |
CVE-2026-61936 |
medium | 5.5 | 0.0030 | 2026-08-11 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a | |
CVE-2026-103560 |
medium | 5.5 | 0.0032 | 2026-10-13 | Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
CVE-2026-96926 |
medium | 5.5 | 0.0032 | 2026-10-13 | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
CVE-2026-69905 |
medium | 5.5 | 0.0034 | 2026-10-13 | Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform ta | |
CVE-2026-70085 |
medium | 5.5 | 0.0032 | 2026-10-13 | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
CVE-2026-83658 |
medium | 5.5 | 0.0035 | 2026-10-13 | Improper access control in Windows Error Reporting allows an authorized attacker to disclose informa | |
CVE-2026-96311 |
medium | 5.5 | 0.0028 | 2026-10-13 | Improper authorization in Windows Network List Service allows an authorized attacker to perform tamp | |
CVE-2026-96315 |
medium | 5.5 | 0.0028 | 2026-10-13 | Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering l | |
CVE-2026-96316 |
medium | 5.5 | 0.0028 | 2026-10-13 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized att | |
CVE-2026-96855 |
medium | 5.5 | 0.0028 | 2026-10-13 | Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to p | |
CVE-2026-20696 |
medium | 5.5 | 0.0012 | 2026-05-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Se | |
CVE-2026-40722 |
medium | 5.5 | 0.0019 | 2026-06-17 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Conf | |
CVE-2026-44918 |
medium | 5.5 | 0.0041 | 2026-07-10 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project withou |