Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-11876 |
medium | 5.0 | 0.0023 | 2026-07-21 | In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_s | |
CVE-2026-16799 |
medium | 5.0 | 0.0025 | 2026-07-24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Uni | |
CVE-2026-65568 |
medium | 5.0 | 0.0028 | 2026-07-27 | Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. | |
CVE-2026-29180 |
medium | 4.9 | 0.0033 | 2026-03-27 | Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerabil | |
CVE-2026-27673 |
medium | 4.9 | 0.0016 | 2026-04-14 | Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authentic | |
CVE-2026-50282 |
medium | 4.9 | 0.0035 | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and ve | |
CVE-2026-48492 |
medium | 4.9 | 0.0039 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/ | |
CVE-2026-61952 |
medium | 4.9 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor wo | |
CVE-2026-105935 |
medium | 4.9 | 0.0040 | 2026-10-21 | The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes | |
CVE-2026-114740 |
medium | 4.9 | 0.0025 | 2026-10-25 | The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a t | |
CVE-2026-10752 |
medium | 4.8 | 0.0025 | 2026-10-27 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in a | |
CVE-2026-105619 |
medium | 4.8 | 0.0015 | 2026-10-28 | PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolv | |
CVE-2026-48783 |
medium | 4.8 | 0.0017 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated | |
CVE-2026-65531 |
medium | 4.8 | 0.0022 | 2026-07-23 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | |
CVE-2026-110010 |
medium | 4.8 | 0.0021 | 2026-10-22 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any cap | |
CVE-2026-39595 |
medium | 4.7 | 0.0021 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. | |
CVE-2026-15060 |
medium | 4.7 | 0.0008 | 2026-08-10 | When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` | |
CVE-2026-84912 |
medium | 4.6 | 0.0019 | 2026-10-22 | Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. | |
CVE-2026-84913 |
medium | 4.6 | 0.0019 | 2026-10-22 | Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affe | |
CVE-2023-2085 |
medium | 4.3 | 0.0061 | 2023-06-09 | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to | |
CVE-2024-24709 |
medium | 4.3 | 0.0019 | 2026-06-17 | Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access C | |
CVE-2026-11592 |
medium | 4.3 | 0.0049 | 2026-07-02 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for Wo | |
CVE-2024-12145 |
medium | 4.3 | 0.0026 | 2026-09-11 | The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version | |
CVE-2026-116660 |
medium | 4.3 | 0.0023 | 2026-10-27 | Tanium addressed an improper access controls vulnerability in Enforce. | |
CVE-2026-109979 |
medium | 4.3 | 0.0030 | 2026-10-28 | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure | |
CVE-2026-109980 |
medium | 4.3 | 0.0022 | 2026-10-28 | The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure | |
CVE-2026-111213 |
medium | 4.3 | 0.0022 | 2026-10-28 | The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to a | |
CVE-2026-111372 |
medium | 4.3 | 0.0027 | 2026-10-28 | The AI ChatBot for WooCommerce – WoowBot plugin for WordPress is vulnerable to authorization bypass | |
CVE-2026-116610 |
medium | 4.3 | 0.0020 | 2026-10-28 | The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and i | |
CVE-2026-85655 |
medium | 4.3 | 0.0027 | 2026-10-28 | The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions | |
CVE-2026-50543 |
medium | 4.3 | 0.0022 | 2026-10-28 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2023-27462 |
medium | 4.3 | 0.0052 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3). The client query ha | |
CVE-2025-62028 |
medium | 4.3 | 0.0024 | 2025-11-06 | Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from | |
CVE-2025-66532 |
medium | 4.3 | 0.0028 | 2025-12-09 | Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrect | |
CVE-2026-0674 |
medium | 4.3 | 0.0022 | 2026-01-08 | Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploi | |
CVE-2026-35598 |
medium | 4.3 | 0.0022 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResour | |
CVE-2026-27672 |
medium | 4.3 | 0.0017 | 2026-04-14 | The Material Master application does not enforce authorization checks for authenticated users when e | |
CVE-2026-27676 |
medium | 4.3 | 0.0016 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Struct | |
CVE-2026-33214 |
medium | 4.3 | 0.0024 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API expo | |
CVE-2026-42648 |
medium | 4.3 | 0.0016 | 2026-04-29 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows | |
CVE-2026-42519 |
medium | 4.3 | 0.0017 | 2026-04-29 | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows | |
CVE-2026-42522 |
medium | 4.3 | 0.0018 | 2026-04-29 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier | |
CVE-2026-20189 |
medium | 4.3 | 0.0021 | 2026-05-06 | A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an& | |
CVE-2026-20193 |
medium | 4.3 | 0.0022 | 2026-05-06 | A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, r | |
CVE-2026-40134 |
medium | 4.3 | 0.0020 | 2026-05-12 | Due to insufficient authorization checks in the SAP Incentive and Commission Management application, | |
CVE-2026-8407 |
medium | 4.3 | 0.0020 | 2026-05-12 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PA | |
CVE-2026-42541 |
medium | 4.3 | 0.0017 | 2026-05-12 | Kubewarden is a policy engine for Kubernetes. Prior to , An attacker with privileged AdmissionPolicy | |
CVE-2026-5146 |
medium | 4.3 | 0.0016 | 2026-05-12 | Improper access control in the notification management endpoints in Devolutions Server allows an una | |
CVE-2026-45442 |
medium | 4.3 | 0.0024 | 2026-05-19 | Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly | |
CVE-2026-48971 |
medium | 4.3 | 0.0023 | 2026-05-27 | Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploi |