Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-84916 |
low | 3.7 | 0.0025 | 2026-10-22 | Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing. This issue affect | |
CVE-2026-109931 |
low | 3.7 | 0.0024 | 2026-10-22 | The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce chec | |
CVE-2026-112230 |
low | 3.7 | 0.0021 | 2026-10-23 | The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashi | |
CVE-2026-108685 |
low | 3.7 | 0.0020 | 2026-10-29 | The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before | |
CVE-2026-105612 |
low | 3.5 | 0.0016 | 2026-10-28 | PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only rest | |
CVE-2026-0057 |
low | 3.3 | 0.0006 | 2026-06-17 | In Contacts Provider, there is a possible way to access an incoming call's phone number and associat | |
CVE-2026-11909 |
low | 3.3 | 0.0021 | 2026-07-10 | Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This | |
CVE-2026-13235 |
low | 3.3 | 0.0021 | 2026-07-10 | Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. | |
CVE-2026-52839 |
low | 3.3 | 0.0018 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter p | |
CVE-2026-113797 |
low | 3.1 | 0.0059 | 2026-10-21 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C | |
CVE-2026-65926 |
low | 3.1 | 0.0024 | 2026-08-12 | An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may lea | |
CVE-2026-113648 |
low | 3.1 | 0.0033 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-expo | |
CVE-2026-113875 |
low | 3.1 | 0.0027 | 2026-10-22 | On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscripti | |
CVE-2026-113501 |
low | 3.1 | 0.0019 | 2026-10-23 | The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-n | |
CVE-2026-114743 |
low | 3.1 | 0.0017 | 2026-10-25 | The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its Inst | |
CVE-2026-4292 |
low | 2.7 | 0.0029 | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Admin changel | |
CVE-2026-13173 |
low | 2.7 | 0.0028 | 2026-08-19 | The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit ot | |
CVE-2026-111981 |
low | 2.7 | 0.0017 | 2026-10-25 | The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor | |
CVE-2026-109564 |
low | 2.3 | 0.0019 | 2026-10-12 | LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{ | |
CVE-2026-114071 |
low | 2.3 | 0.0028 | 2026-10-21 | Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated p | |
CVE-2026-62235 |
low | 2.3 | 0.0029 | 2026-07-17 | Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-n | |
CVE-2026-75850 |
low | 2.3 | 0.0021 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and t | |
CVE-2026-104949 |
low | 2.3 | 0.0022 | 2026-10-21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authoriza | |
CVE-2026-105931 |
low | 2.3 | 0.0050 | 2026-10-21 | The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. | |
CVE-2026-105932 |
low | 2.3 | 0.0050 | 2026-10-21 | The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level e | |
CVE-2026-4968 |
low | 2.1 | 0.0020 | 2026-03-27 | A vulnerability was determined in SourceCodester Diary App 1.0. The affected element is an unknown f | |
CVE-2026-4971 |
low | 2.1 | 0.0016 | 2026-03-27 | A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown | |
CVE-2026-6109 |
low | 2.1 | 0.0022 | 2026-04-12 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the | |
CVE-2026-7108 |
low | 2.1 | 0.0015 | 2026-04-27 | A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affe | |
CVE-2026-13537 |
low | 2.1 | 0.0023 | 2026-06-29 | A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown | |
CVE-2026-15034 |
low | 2.1 | 0.0029 | 2026-07-08 | A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by | |
CVE-2026-15320 |
low | 2.1 | 0.0040 | 2026-07-10 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function | |
CVE-2026-15332 |
low | 2.1 | 0.0037 | 2026-07-10 | A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unk | |
CVE-2026-15507 |
low | 2.1 | 0.0035 | 2026-07-12 | A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown f | |
CVE-2026-16017 |
low | 2.1 | 0.0037 | 2026-07-17 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/r | |
CVE-2026-16081 |
low | 2.1 | 0.0024 | 2026-07-18 | A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown fu | |
CVE-2026-16123 |
low | 2.1 | 0.0037 | 2026-07-18 | A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is th | |
CVE-2026-16197 |
low | 2.1 | 0.0037 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is t | |
CVE-2026-16216 |
low | 2.1 | 0.0023 | 2026-07-19 | A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function | |
CVE-2026-77391 |
low | 2.1 | 0.0023 | 2026-08-21 | A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, | |
CVE-2026-115364 |
low | 2.1 | 0.0032 | 2026-10-22 | OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and | |
CVE-2026-115796 |
low | 2.1 | 0.0016 | 2026-10-23 | A security flaw has been discovered in Tenda F6 12.02.01.73. This impacts an unknown function of the | |
CVE-2026-116107 |
low | 2.1 | 0.0022 | 2026-10-26 | A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by | |
CVE-2026-32270 |
low | 1.7 | 0.0029 | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 th | |
CVE-2026-55542 |
low | 1.3 | 0.0028 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature ima | |
CVE-2026-118333 |
— | — | 0.0019 | 2026-10-27 | Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to | |
CVE-2026-112375 |
— | — | 0.0022 | 2026-10-28 | An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a br | |
CVE-2025-20362 |
— | — | 0.8709 | — | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Sof | KEV |
CVE-2026-39506 |
— | — | 0.0016 | 2026-04-08 | Missing Authorization vulnerability in Jordy Meow AI Engine (Pro) ai-engine-pro allows Exploiting In | |
CVE-2026-40728 |
— | — | 0.0014 | 2026-04-15 | Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting In |