Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-114120 |
medium | 5.3 | 0.0029 | 2026-10-21 | SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated | |
CVE-2026-104947 |
medium | 5.3 | 0.0022 | 2026-10-21 | WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862 | |
CVE-2026-105926 |
medium | 5.3 | 0.0041 | 2026-10-21 | The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the sc | |
CVE-2026-105936 |
medium | 5.3 | 0.0050 | 2026-10-21 | The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO con | |
CVE-2026-19947 |
medium | 5.3 | 0.0013 | 2026-10-21 | The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmu | |
CVE-2026-84914 |
medium | 5.3 | 0.0027 | 2026-10-22 | Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing. This | |
CVE-2026-84921 |
medium | 5.3 | 0.0037 | 2026-10-22 | Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing. T | |
CVE-2026-112826 |
medium | 5.3 | 0.0028 | 2026-10-22 | Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon all | |
CVE-2026-114180 |
medium | 5.3 | 0.0025 | 2026-10-22 | Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configure | |
CVE-2026-110893 |
medium | 5.3 | 0.0028 | 2026-10-22 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrec | |
CVE-2026-110894 |
medium | 5.3 | 0.0026 | 2026-10-22 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrec | |
CVE-2026-111842 |
medium | 5.3 | 0.0024 | 2026-10-22 | Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Ex | |
CVE-2026-112218 |
medium | 5.3 | 0.0024 | 2026-10-22 | Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Inc | |
CVE-2026-114696 |
medium | 5.3 | 0.0026 | 2026-10-22 | Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-rest | |
CVE-2026-114699 |
medium | 5.3 | 0.0026 | 2026-10-22 | Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting In | |
CVE-2026-116008 |
medium | 5.3 | 0.0020 | 2026-10-24 | DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::upda | |
CVE-2026-94295 |
medium | 5.3 | 0.0018 | 2026-10-25 | The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a | |
CVE-2026-116052 |
medium | 5.3 | 0.0021 | 2026-10-25 | A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is a | |
CVE-2026-110377 |
medium | 5.3 | 0.0023 | 2026-10-26 | Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo | |
CVE-2026-115614 |
medium | 5.3 | 0.0023 | 2026-10-26 | Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental | |
CVE-2026-115958 |
medium | 5.3 | 0.0026 | 2026-10-26 | Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board a | |
CVE-2026-115595 |
medium | 5.3 | 0.0023 | 2026-10-26 | Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic | |
CVE-2026-115959 |
medium | 5.3 | 0.0023 | 2026-10-26 | Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows | |
CVE-2026-115718 |
medium | 5.3 | 0.0031 | 2026-10-26 | Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the imp | |
CVE-2026-115598 |
medium | 5.3 | 0.0026 | 2026-10-26 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly | |
CVE-2026-116388 |
medium | 5.3 | 0.0023 | 2026-10-26 | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Config | |
CVE-2026-110030 |
medium | 5.3 | 0.0014 | 2026-10-29 | The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration hand | |
CVE-2026-115302 |
medium | 5.3 | 0.0014 | 2026-10-29 | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX ac | |
CVE-2026-78395 |
medium | 5.3 | 0.0014 | 2026-10-29 | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login r | |
CVE-2026-27401 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal | |
CVE-2026-118093 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed all | |
CVE-2026-39741 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstil | |
CVE-2026-39782 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly | |
CVE-2026-114181 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-tax | |
CVE-2026-116387 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorr | |
CVE-2026-116856 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for | |
CVE-2026-118088 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrec | |
CVE-2026-118091 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrec | |
CVE-2026-25450 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploit | |
CVE-2026-54871 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Ad | |
CVE-2026-116846 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploi | |
CVE-2026-48884 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting In | |
CVE-2026-54852 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-rest | |
CVE-2026-97073 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured | |
CVE-2026-115601 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocomm | |
CVE-2026-27063 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting In | |
CVE-2026-54853 |
medium | 5.3 | — | 2026-10-29 | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting | |
CVE-2026-60119 |
medium | 5.1 | 0.0030 | 2026-07-14 | Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated atta | |
CVE-2026-4925 |
medium | 5.0 | 0.0020 | 2026-04-01 | Improper access control in the users MFA feature in Devolutions Server allows an authenticated user | |
CVE-2026-5175 |
medium | 5.0 | 0.0026 | 2026-04-01 | Improper access control in the multi-factor authentication (MFA) management API in Devolutions Serve |