Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-49045 |
medium | 4.3 | 0.0021 | 2026-05-27 | Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured | |
CVE-2026-49047 |
medium | 4.3 | 0.0016 | 2026-05-27 | Missing Authorization vulnerability in DearHive DearFlip allows Exploiting Incorrectly Configured Ac | |
CVE-2026-49051 |
medium | 4.3 | 0.0022 | 2026-05-27 | Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting In | |
CVE-2026-49054 |
medium | 4.3 | 0.0021 | 2026-05-27 | Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Co | |
CVE-2026-53438 |
medium | 4.3 | 0.0021 | 2026-06-10 | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers wi | |
CVE-2026-53439 |
medium | 4.3 | 0.0022 | 2026-06-10 | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with | |
CVE-2026-24575 |
medium | 4.3 | 0.0026 | 2026-06-17 | Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions. | |
CVE-2026-24610 |
medium | 4.3 | 0.0024 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. | |
CVE-2026-40723 |
medium | 4.3 | 0.0024 | 2026-06-17 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. | |
CVE-2026-49288 |
medium | 4.3 | 0.0027 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, | |
CVE-2026-57285 |
medium | 4.3 | 0.0028 | 2026-06-24 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlie | |
CVE-2026-57286 |
medium | 4.3 | 0.0028 | 2026-06-24 | A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows att | |
CVE-2026-57293 |
medium | 4.3 | 0.0027 | 2026-06-24 | An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attac | |
CVE-2026-57297 |
medium | 4.3 | 0.0025 | 2026-06-24 | A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earli | |
CVE-2026-57299 |
medium | 4.3 | 0.0025 | 2026-06-24 | Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlie | |
CVE-2026-57300 |
medium | 4.3 | 0.0028 | 2026-06-24 | A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows atta | |
CVE-2026-2299 |
medium | 4.3 | 0.0020 | 2026-06-25 | The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the | |
CVE-2026-57430 |
medium | 4.3 | 0.0025 | 2026-06-26 | Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions. | |
CVE-2026-57622 |
medium | 4.3 | 0.0027 | 2026-06-26 | Subscriber Broken Access Control in WPCafe <= 3.0.14 versions. | |
CVE-2026-57640 |
medium | 4.3 | 0.0025 | 2026-06-26 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. | |
CVE-2026-57648 |
medium | 4.3 | 0.0025 | 2026-06-26 | Contributor Broken Access Control in Nelio Content <= 4.3.4 versions. | |
CVE-2026-57649 |
medium | 4.3 | 0.0027 | 2026-06-26 | Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions. | |
CVE-2026-12471 |
medium | 4.3 | 0.0034 | 2026-06-27 | The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check | |
CVE-2026-57720 |
medium | 4.3 | 0.0033 | 2026-07-01 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Config | |
CVE-2026-57685 |
medium | 4.3 | 0.0025 | 2026-07-02 | Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 vers | |
CVE-2026-57689 |
medium | 4.3 | 0.0027 | 2026-07-02 | Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions. | |
CVE-2026-57730 |
medium | 4.3 | 0.0027 | 2026-07-02 | Subscriber Broken Access Control in Flatsome <= 3.20.5 versions. | |
CVE-2026-25714 |
medium | 4.3 | 0.0039 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to t | |
CVE-2026-27783 |
medium | 4.3 | 0.0035 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-temp | |
CVE-2026-57797 |
medium | 4.3 | 0.0033 | 2026-07-13 | Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Confi | |
CVE-2026-44770 |
medium | 4.3 | 0.0028 | 2026-07-14 | SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, | |
CVE-2026-44771 |
medium | 4.3 | 0.0028 | 2026-07-14 | SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated use | |
CVE-2026-54568 |
medium | 4.3 | 0.0059 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3. | |
CVE-2026-57205 |
medium | 4.3 | 0.0091 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-g | |
CVE-2026-47089 |
medium | 4.3 | 0.0028 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to us | |
CVE-2026-16454 |
medium | 4.3 | 0.0036 | 2026-07-21 | In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862 | |
CVE-2026-63143 |
medium | 4.3 | 0.0033 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privil | |
CVE-2026-63262 |
medium | 4.3 | 0.0028 | 2026-07-22 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosur | |
CVE-2026-25424 |
medium | 4.3 | 0.0025 | 2026-07-23 | Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. | |
CVE-2026-27392 |
medium | 4.3 | 0.0025 | 2026-07-23 | Contributor Broken Access Control in uListing <= 2.2.0 versions. | |
CVE-2026-27423 |
medium | 4.3 | 0.0025 | 2026-07-23 | Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. | |
CVE-2026-61973 |
medium | 4.3 | 0.0025 | 2026-07-23 | Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions. | |
CVE-2026-65457 |
medium | 4.3 | 0.0025 | 2026-07-23 | Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions. | |
CVE-2026-65491 |
medium | 4.3 | 0.0027 | 2026-07-23 | Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions. | |
CVE-2026-65524 |
medium | 4.3 | 0.0027 | 2026-07-23 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | |
CVE-2026-65537 |
medium | 4.3 | 0.0025 | 2026-07-23 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= | |
CVE-2026-67529 |
medium | 4.3 | 0.0041 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time | |
CVE-2026-70433 |
medium | 4.3 | 0.0027 | 2026-08-05 | Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overa | |
CVE-2026-70436 |
medium | 4.3 | 0.0029 | 2026-08-05 | Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4 | |
CVE-2026-70438 |
medium | 4.3 | 0.0027 | 2026-08-05 | A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows a |