Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-74040 |
critical | 9.4 | 0.0072 | 2026-10-13 | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterH | |
CVE-2026-40189 |
critical | 9.3 | 0.0064 | 2026-04-10 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per- | |
CVE-2026-5387 |
critical | 9.3 | 0.0039 | 2026-04-15 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations inte | |
CVE-2026-44125 |
critical | 9.3 | 0.0039 | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multip | |
CVE-2026-41315 |
critical | 9.3 | 0.0103 | 2026-05-14 | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end unauthoriz | |
CVE-2026-58473 |
critical | 9.3 | 0.0051 | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated at | |
CVE-2026-46515 |
critical | 9.3 | 0.0057 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was | |
CVE-2026-64622 |
critical | 9.3 | 0.0052 | 2026-07-20 | Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorizati | |
CVE-2026-47754 |
critical | 9.3 | 0.0047 | 2026-08-10 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versi | |
CVE-2026-75832 |
critical | 9.3 | 0.0030 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in | |
CVE-2026-75835 |
critical | 9.3 | 0.0031 | 2026-08-18 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerabili | |
CVE-2026-109444 |
critical | 9.3 | 0.0070 | 2026-10-20 | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers | |
CVE-2026-77930 |
critical | 9.3 | 0.0069 | 2026-10-20 | EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to r | |
CVE-2026-93328 |
critical | 9.3 | 0.0053 | 2026-10-26 | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Dat | |
CVE-2026-105209 |
critical | 9.3 | 0.0022 | 2026-10-04 | ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: wh | |
CVE-2026-93865 |
critical | 9.2 | 0.0046 | 2026-10-27 | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows | |
CVE-2026-68586 |
critical | 9.2 | 0.0041 | 2026-08-03 | SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionD | |
CVE-2026-68587 |
critical | 9.2 | 0.0032 | 2026-08-03 | SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDelet | |
CVE-2026-72789 |
critical | 9.2 | 0.0037 | 2026-08-12 | SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating the | |
CVE-2026-72795 |
critical | 9.2 | 0.0031 | 2026-08-12 | SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBloc | |
CVE-2026-72798 |
critical | 9.2 | 0.0043 | 2026-08-12 | SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeVie | |
CVE-2026-73608 |
critical | 9.2 | 0.0031 | 2026-08-13 | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or maste | |
CVE-2026-67443 |
critical | 9.2 | 0.0069 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the | |
CVE-2026-6512 |
critical | 9.1 | 0.0026 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, | |
CVE-2026-48881 |
critical | 9.1 | 0.0028 | 2026-06-15 | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. | |
CVE-2026-24611 |
critical | 9.1 | 0.0044 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. | |
CVE-2026-62232 |
critical | 9.1 | 0.0035 | 2026-07-17 | Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin wher | |
CVE-2026-12694 |
critical | 9.1 | 0.0044 | 2026-07-17 | Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Func | |
CVE-2026-28309 |
critical | 9.1 | 0.0050 | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administ | |
CVE-2026-28310 |
critical | 9.1 | 0.0050 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr | |
CVE-2026-14488 |
critical | 9.1 | 0.0052 | 2026-07-29 | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redire | |
CVE-2026-90863 |
critical | 9.1 | — | 2026-10-29 | Missing authorization in the administrative interface of Progress Software WS_FTP Server versions pr | |
CVE-2026-114661 |
critical | 9.0 | 0.0035 | 2026-10-22 | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResou | |
CVE-2026-112380 |
critical | 9.0 | 0.0041 | 2026-10-20 | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a | |
CVE-2026-61707 |
critical | 9.0 | — | 2026-10-29 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations nee | |
CVE-2026-43639 |
high | 8.9 | 0.0060 | 2026-05-11 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a pro | |
CVE-2026-17601 |
high | 8.9 | 0.0052 | 2026-08-07 | A user holding a permission to update privilege definitions could modify a wildcard privilege alread | |
CVE-2026-63921 |
high | 8.8 | 0.0016 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vt | |
CVE-2026-114135 |
high | 8.8 | 0.0048 | 2026-10-21 | Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling Gateway | |
CVE-2026-58255 |
high | 8.8 | 0.0042 | 2026-10-27 | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.12 | |
CVE-2026-116778 |
high | 8.8 | 0.0047 | 2026-10-28 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10. | |
CVE-2026-56828 |
high | 8.8 | 0.0044 | 2026-10-28 | Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin c | |
CVE-2026-55052 |
high | 8.8 | 0.0094 | 2026-07-14 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privil | |
CVE-2026-59113 |
high | 8.8 | 0.0076 | 2026-08-11 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a n | |
CVE-2026-88164 |
high | 8.8 | 0.0084 | 2026-10-14 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privil | |
CVE-2026-102861 |
high | 8.8 | 0.0081 | 2026-10-13 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privil | |
CVE-2026-69945 |
high | 8.8 | 0.0032 | 2026-10-13 | Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate | |
CVE-2026-70098 |
high | 8.8 | 0.0058 | 2026-10-13 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a n | |
CVE-2026-88198 |
high | 8.8 | 0.0071 | 2026-10-13 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privil | |
CVE-2023-27309 |
high | 8.8 | 0.0048 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query ha |