Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-25440 |
medium | 5.3 | 0.0021 | 2026-06-15 | Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions. | |
CVE-2026-56384 |
medium | 5.3 | 0.0033 | 2026-06-21 | Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Con | |
CVE-2026-56696 |
medium | 5.3 | 0.0037 | 2026-06-23 | OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing | |
CVE-2026-57521 |
medium | 5.3 | 0.0043 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any auth | |
CVE-2026-57922 |
medium | 5.3 | 0.0024 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | |
CVE-2026-57925 |
medium | 5.3 | 0.0027 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and | |
CVE-2026-24547 |
medium | 5.3 | 0.0029 | 2026-06-26 | Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. | |
CVE-2026-57660 |
medium | 5.3 | 0.0029 | 2026-06-26 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions. | |
CVE-2026-57954 |
medium | 5.3 | 0.0021 | 2026-06-29 | Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in Sorting | |
CVE-2026-58373 |
medium | 5.3 | 0.0034 | 2026-06-30 | CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_quer | |
CVE-2026-27435 |
medium | 5.3 | 0.0029 | 2026-07-01 | Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Ac | |
CVE-2026-27409 |
medium | 5.3 | 0.0032 | 2026-07-01 | Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Con | |
CVE-2026-57721 |
medium | 5.3 | 0.0029 | 2026-07-01 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configu | |
CVE-2026-50283 |
medium | 5.3 | 0.0036 | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 thr | |
CVE-2026-57750 |
medium | 5.3 | 0.0029 | 2026-07-02 | Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions. | |
CVE-2026-57760 |
medium | 5.3 | 0.0029 | 2026-07-02 | Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Co | |
CVE-2026-12557 |
medium | 5.3 | 0.0035 | 2026-07-03 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all ver | |
CVE-2026-59709 |
medium | 5.3 | 0.0034 | 2026-07-07 | Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access. | |
CVE-2026-49274 |
medium | 5.3 | 0.0048 | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the p | |
CVE-2026-55476 |
medium | 5.3 | 0.0034 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/ | |
CVE-2026-57221 |
medium | 5.3 | 0.0041 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ | |
CVE-2026-57774 |
medium | 5.3 | 0.0042 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Inco | |
CVE-2026-57776 |
medium | 5.3 | 0.0042 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly | |
CVE-2026-57778 |
medium | 5.3 | 0.0029 | 2026-07-13 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking | |
CVE-2026-57779 |
medium | 5.3 | 0.0029 | 2026-07-13 | Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly C | |
CVE-2026-57781 |
medium | 5.3 | 0.0029 | 2026-07-13 | Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Co | |
CVE-2026-57782 |
medium | 5.3 | 0.0029 | 2026-07-13 | Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiti | |
CVE-2026-61983 |
medium | 5.3 | 0.0029 | 2026-07-13 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorr | |
CVE-2026-61985 |
medium | 5.3 | 0.0029 | 2026-07-13 | Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows E | |
CVE-2026-46459 |
medium | 5.3 | 0.0043 | 2026-07-15 | ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endp | |
CVE-2026-33684 |
medium | 5.3 | 0.0024 | 2026-07-15 | WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possibl | |
CVE-2026-63082 |
medium | 5.3 | 0.0026 | 2026-07-16 | Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control | |
CVE-2026-45334 |
medium | 5.3 | 0.0036 | 2026-07-16 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content | |
CVE-2026-15783 |
medium | 5.3 | 0.0045 | 2026-07-17 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an aut | |
CVE-2026-8593 |
medium | 5.3 | 0.0035 | 2026-07-21 | Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3 | |
CVE-2026-63092 |
medium | 5.3 | 0.0028 | 2026-07-21 | kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerabili | |
CVE-2026-65011 |
medium | 5.3 | 0.0038 | 2026-07-22 | Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /ev | |
CVE-2026-25466 |
medium | 5.3 | 0.0031 | 2026-07-23 | Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. | |
CVE-2026-27355 |
medium | 5.3 | 0.0038 | 2026-07-23 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | |
CVE-2026-27399 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. | |
CVE-2026-27418 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. | |
CVE-2026-27422 |
medium | 5.3 | 0.0029 | 2026-07-23 | Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Co | |
CVE-2026-61972 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | |
CVE-2026-65452 |
medium | 5.3 | 0.0031 | 2026-07-23 | Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | |
CVE-2026-65453 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | |
CVE-2026-65468 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. | |
CVE-2026-65469 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. | |
CVE-2026-65472 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions. | |
CVE-2026-65476 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. | |
CVE-2026-65485 |
medium | 5.3 | 0.0031 | 2026-07-23 | Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions. |