Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65487 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. | |
CVE-2026-65506 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5. | |
CVE-2026-65525 |
medium | 5.3 | 0.0029 | 2026-07-23 | Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | |
CVE-2026-65529 |
medium | 5.3 | 0.0031 | 2026-07-23 | Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor gra | |
CVE-2026-65567 |
medium | 5.3 | 0.0029 | 2026-07-27 | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. | |
CVE-2026-66477 |
medium | 5.3 | 0.0029 | 2026-07-27 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. | |
CVE-2026-66750 |
medium | 5.3 | 0.0035 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authentica | |
CVE-2026-66751 |
medium | 5.3 | 0.0030 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any auth | |
CVE-2026-66724 |
medium | 5.3 | 0.0044 | 2026-07-29 | MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecat | |
CVE-2026-15227 |
medium | 5.3 | 0.0035 | 2026-07-31 | Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenti | |
CVE-2026-17350 |
medium | 5.3 | 0.0038 | 2026-07-31 | The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 | |
CVE-2026-67616 |
medium | 5.3 | 0.0044 | 2026-08-03 | Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability | |
CVE-2026-32548 |
medium | 5.3 | 0.0031 | 2026-08-06 | Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions. | |
CVE-2026-66699 |
medium | 5.3 | 0.0029 | 2026-08-06 | Custom role Broken Access Control in Dokan <= 5.0.10 versions. | |
CVE-2026-66701 |
medium | 5.3 | 0.0029 | 2026-08-06 | Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. | |
CVE-2026-48077 |
medium | 5.3 | 0.0043 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-19350 |
medium | 5.3 | 0.0026 | 2026-08-09 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the fi | |
CVE-2026-73140 |
medium | 5.3 | 0.0035 | 2026-08-11 | Affected versions of cti-transmute fail to apply comment-level access-control rules when generating | |
CVE-2026-73155 |
medium | 5.3 | 0.0035 | 2026-08-11 | Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on com | |
CVE-2026-56720 |
medium | 5.3 | 0.0034 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin us | |
CVE-2026-69113 |
medium | 5.3 | 0.0027 | 2026-08-11 | Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint th | |
CVE-2026-66377 |
medium | 5.3 | 0.0036 | 2026-08-12 | An unauthenticated user may access restricted repository information under specific conditions. | |
CVE-2026-68753 |
medium | 5.3 | 0.0031 | 2026-08-12 | An unauthenticated user may access restricted Artifactory content when a credentialed remote reposit | |
CVE-2026-73349 |
medium | 5.3 | 0.0029 | 2026-08-13 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | |
CVE-2026-73353 |
medium | 5.3 | 0.0031 | 2026-08-13 | Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions. | |
CVE-2026-73401 |
medium | 5.3 | 0.0029 | 2026-08-13 | Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. | |
CVE-2026-73403 |
medium | 5.3 | 0.0029 | 2026-08-13 | Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | |
CVE-2026-75151 |
medium | 5.3 | 0.0022 | 2026-08-18 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. | |
CVE-2026-55106 |
medium | 5.3 | 0.0044 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action o | |
CVE-2026-65959 |
medium | 5.3 | 0.0043 | 2026-08-18 | Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the / | |
CVE-2026-76032 |
medium | 5.3 | 0.0038 | 2026-08-18 | Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handl | |
CVE-2026-53569 |
medium | 5.3 | 0.0046 | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted to | |
CVE-2026-16962 |
medium | 5.3 | 0.0030 | 2026-08-21 | The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any | |
CVE-2026-78258 |
medium | 5.3 | 0.0031 | 2026-08-24 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. | |
CVE-2026-104079 |
medium | 5.3 | 0.0019 | 2026-10-09 | Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conv | |
CVE-2026-108706 |
medium | 5.3 | 0.0019 | 2026-10-11 | eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Stora | |
CVE-2026-109171 |
medium | 5.3 | 0.0020 | 2026-10-12 | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated | |
CVE-2026-109296 |
medium | 5.3 | 0.0034 | 2026-10-12 | Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated us | |
CVE-2026-109356 |
medium | 5.3 | 0.0019 | 2026-10-12 | LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that | |
CVE-2026-110100 |
medium | 5.3 | 0.0022 | 2026-10-13 | Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allow | |
CVE-2026-110110 |
medium | 5.3 | 0.0030 | 2026-10-13 | JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users w | |
CVE-2026-111668 |
medium | 5.3 | 0.0029 | 2026-10-16 | AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py t | |
CVE-2026-111683 |
medium | 5.3 | 0.0029 | 2026-10-16 | Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenti | |
CVE-2026-112293 |
medium | 5.3 | 0.0018 | 2026-10-19 | BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that | |
CVE-2026-112328 |
medium | 5.3 | 0.0016 | 2026-10-19 | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the | |
CVE-2026-112329 |
medium | 5.3 | 0.0018 | 2026-10-19 | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the | |
CVE-2026-112783 |
medium | 5.3 | 0.0026 | 2026-10-20 | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and | |
CVE-2026-113595 |
medium | 5.3 | 0.0032 | 2026-10-20 | Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC | |
CVE-2026-113601 |
medium | 5.3 | 0.0031 | 2026-10-20 | Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivi | |
CVE-2026-114057 |
medium | 5.3 | 0.0029 | 2026-10-21 | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt proto |