Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1099)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-25427 |
medium | 5.4 | 0.0029 | 2026-07-23 | Subscriber Broken Access Control in eRoom <= 1.7.1 versions. | |
CVE-2026-27391 |
medium | 5.4 | 0.0029 | 2026-07-23 | Subscriber Broken Access Control in uListing <= 2.2.0 versions. | |
CVE-2026-65478 |
medium | 5.4 | 0.0023 | 2026-07-23 | Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. | |
CVE-2026-65479 |
medium | 5.4 | 0.0029 | 2026-07-23 | Subscriber Broken Access Control in Reviewer <= 3.14.2 versions. | |
CVE-2026-66442 |
medium | 5.4 | 0.0029 | 2026-07-27 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. | |
CVE-2026-65922 |
medium | 5.4 | 0.0034 | 2026-07-27 | An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with li | |
CVE-2026-28147 |
medium | 5.4 | 0.0029 | 2026-08-03 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Wid | |
CVE-2026-72918 |
medium | 5.4 | 0.0022 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, | |
CVE-2026-74004 |
medium | 5.4 | 0.0023 | 2026-08-18 | Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms < | |
CVE-2026-66589 |
medium | 5.4 | 0.0023 | 2026-08-18 | Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configure | |
CVE-2026-59992 |
medium | 5.4 | 0.0038 | 2026-08-19 | Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0 | |
CVE-2026-111847 |
medium | 5.4 | 0.0019 | 2026-10-22 | Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-f | |
CVE-2026-114175 |
medium | 5.4 | 0.0026 | 2026-10-22 | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting | |
CVE-2026-107887 |
medium | 5.4 | 0.0014 | 2026-10-24 | The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonc | |
CVE-2026-97353 |
medium | 5.4 | 0.0022 | 2026-10-24 | The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or owne | |
CVE-2026-115954 |
medium | 5.4 | 0.0018 | 2026-10-26 | Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrect | |
CVE-2026-115597 |
medium | 5.4 | 0.0018 | 2026-10-26 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly | |
CVE-2026-42690 |
medium | 5.4 | — | 2026-10-29 | Subscriber Broken Access Control in LearnPress <= 4.4.10 versions. | |
CVE-2025-63031 |
medium | 5.3 | 0.0021 | 2025-12-31 | Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Ex | |
CVE-2026-64965 |
medium | 5.3 | 0.0039 | 2026-08-20 | ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-pr | |
CVE-2026-114056 |
medium | 5.3 | 0.0030 | 2026-10-21 | ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read- | |
CVE-2026-114058 |
medium | 5.3 | 0.0029 | 2026-10-21 | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt proto | |
CVE-2026-116677 |
medium | 5.3 | 0.0018 | 2026-10-27 | OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, upd | |
CVE-2026-115624 |
medium | 5.3 | 0.0022 | 2026-10-28 | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By | |
CVE-2026-105997 |
medium | 5.3 | 0.0030 | 2026-10-28 | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking ver | |
CVE-2026-106002 |
medium | 5.3 | 0.0023 | 2026-10-28 | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce ve | |
CVE-2026-107097 |
medium | 5.3 | 0.0023 | 2026-10-28 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not perform any authorization | |
CVE-2026-2839 |
medium | 5.3 | 0.0027 | 2026-10-28 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthorized access of da | |
CVE-2026-76058 |
medium | 5.3 | 0.0026 | 2026-10-28 | The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all | |
CVE-2026-110508 |
medium | 5.3 | 0.0027 | 2026-10-28 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not apply its administrator ap | |
CVE-2026-118426 |
medium | 5.3 | 0.0027 | 2026-10-29 | In affected versions of Octopus Server with the LDAP authentication provider enabled, any authentica | |
CVE-2025-67572 |
medium | 5.3 | 0.0025 | 2025-12-09 | Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Con | |
CVE-2025-67573 |
medium | 5.3 | 0.0025 | 2025-12-09 | Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Confi | |
CVE-2026-0676 |
medium | 5.3 | 0.0025 | 2026-01-08 | Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured | |
CVE-2026-33759 |
medium | 5.3 | 0.0031 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pla | |
CVE-2026-33761 |
medium | 5.3 | 0.0040 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json | |
CVE-2026-34369 |
medium | 5.3 | 0.0039 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_vid | |
CVE-2026-34899 |
medium | 5.3 | 0.0024 | 2026-04-07 | Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edi | |
CVE-2026-32648 |
medium | 5.3 | 0.0025 | 2026-04-17 | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration | |
CVE-2026-33093 |
medium | 5.3 | 0.0025 | 2026-04-17 | Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo wit | |
CVE-2026-35061 |
medium | 5.3 | 0.0030 | 2026-04-17 | Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved wit | |
CVE-2026-40098 |
medium | 5.3 | 0.0018 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-41128 |
medium | 5.3 | 0.0025 | 2026-04-22 | Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePer | |
CVE-2026-42642 |
medium | 5.3 | 0.0019 | 2026-04-29 | Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configure | |
CVE-2026-27416 |
medium | 5.3 | 0.0018 | 2026-05-07 | Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured | |
CVE-2026-43638 |
medium | 5.3 | 0.0019 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any a | |
CVE-2026-45212 |
medium | 5.3 | 0.0022 | 2026-05-12 | Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-u | |
CVE-2026-25431 |
medium | 5.3 | 0.0023 | 2026-05-12 | Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Acce | |
CVE-2026-45007 |
medium | 5.3 | 0.0026 | 2026-05-15 | phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 | |
CVE-2026-46365 |
medium | 5.3 | 0.0022 | 2026-05-15 | phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/conten |