Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-70447 |
medium | 4.3 | 0.0027 | 2026-08-05 | Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Over | |
CVE-2026-66678 |
medium | 4.3 | 0.0027 | 2026-08-06 | Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions. | |
CVE-2026-18276 |
medium | 4.3 | 0.0036 | 2026-08-06 | Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a rem | |
CVE-2026-64664 |
medium | 4.3 | 0.0034 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, a | |
CVE-2026-72906 |
medium | 4.3 | 0.0035 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, | |
CVE-2026-72919 |
medium | 4.3 | 0.0032 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, | |
CVE-2026-58244 |
medium | 4.3 | 0.0028 | 2026-08-11 | SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check | |
CVE-2026-66772 |
medium | 4.3 | 0.0031 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient author | |
CVE-2026-66378 |
medium | 4.3 | 0.0030 | 2026-08-12 | An authenticated user without repository read permission may access private NuGet metadata under spe | |
CVE-2026-66379 |
medium | 4.3 | 0.0030 | 2026-08-12 | An authenticated user may view private Puppet module metadata without repository read access. | |
CVE-2026-66380 |
medium | 4.3 | 0.0030 | 2026-08-12 | An authenticated user without repository read permission may access private OCI referrer metadata un | |
CVE-2026-65938 |
medium | 4.3 | 0.0025 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Sc | |
CVE-2026-70547 |
medium | 4.3 | 0.0028 | 2026-08-12 | An authenticated user without repository read permission may access package metadata under specific | |
CVE-2026-74003 |
medium | 4.3 | 0.0025 | 2026-08-18 | Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions. | |
CVE-2026-74006 |
medium | 4.3 | 0.0025 | 2026-08-18 | Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions. | |
CVE-2026-71322 |
medium | 4.3 | 0.0023 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePerm | |
CVE-2026-61663 |
medium | 4.3 | 0.0034 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by | |
CVE-2026-5093 |
medium | 4.3 | 0.0037 | 2026-08-22 | The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorize | |
CVE-2026-114477 |
medium | 4.3 | 0.0021 | 2026-10-21 | Missing authorization in the REST metrics route of Progressive Robot hMailServer 6.2.25 through 6.3. | |
CVE-2026-114176 |
medium | 4.3 | 0.0027 | 2026-10-21 | Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting | |
CVE-2026-76294 |
medium | 4.3 | 0.0027 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold th | |
CVE-2026-76296 |
medium | 4.3 | 0.0021 | 2026-10-21 | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold th | |
CVE-2026-76304 |
medium | 4.3 | 0.0016 | 2026-10-21 | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission | |
CVE-2026-87954 |
medium | 4.3 | 0.0026 | 2026-10-22 | Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This | |
CVE-2026-87955 |
medium | 4.3 | 0.0024 | 2026-10-22 | Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This is | |
CVE-2026-112843 |
medium | 4.3 | 0.0020 | 2026-10-22 | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Explo | |
CVE-2026-114182 |
medium | 4.3 | 0.0022 | 2026-10-22 | Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-li | |
CVE-2026-97352 |
medium | 4.3 | 0.0020 | 2026-10-24 | The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check | |
CVE-2026-110376 |
medium | 4.3 | 0.0015 | 2026-10-26 | Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo all | |
CVE-2026-112828 |
medium | 4.3 | 0.0015 | 2026-10-26 | Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly C | |
CVE-2026-115960 |
medium | 4.3 | 0.0020 | 2026-10-26 | Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows | |
CVE-2026-112839 |
medium | 4.3 | 0.0020 | 2026-10-26 | Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coup | |
CVE-2026-22386 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrect | |
CVE-2026-42707 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings a | |
CVE-2026-93010 |
medium | 4.3 | — | 2026-10-29 | A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresse | |
CVE-2026-115605 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrec | |
CVE-2026-116406 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploit | |
CVE-2026-118092 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-manag | |
CVE-2026-52708 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting In | |
CVE-2026-25448 |
medium | 4.3 | — | 2026-10-29 | Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Ac | |
CVE-2026-18799 |
medium | 4.3 | 0.0020 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-57307 |
medium | 4.2 | 0.0021 | 2026-06-24 | A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allow | |
CVE-2026-13236 |
medium | 4.2 | 0.0019 | 2026-07-10 | Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects | |
CVE-2026-70435 |
medium | 4.2 | 0.0019 | 2026-08-05 | A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Ov | |
CVE-2026-58241 |
medium | 4.2 | 0.0025 | 2026-08-11 | SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard | |
CVE-2026-84910 |
medium | 4.2 | 0.0019 | 2026-10-22 | Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing. This issue a | |
CVE-2026-0145 |
medium | 4.0 | 0.0008 | 2026-06-16 | In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead | |
CVE-2026-0158 |
medium | 4.0 | 0.0007 | 2026-06-16 | In Camera, there is a possible unauthorized way to access photos due to a missing permission check. | |
CVE-2026-106647 |
low | 3.8 | 0.0019 | 2026-10-28 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's ema | |
CVE-2026-113665 |
low | 3.7 | 0.0035 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification |