Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2023-27310 |
high | 8.8 | 0.0063 | 2023-03-14 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query ha | |
CVE-2026-0628 |
high | 8.8 | 0.2095 | 2026-01-07 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an a | |
CVE-2026-34184 |
high | 8.8 | 0.0029 | 2026-04-09 | AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attac | |
CVE-2026-40349 |
high | 8.8 | 0.0053 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, | |
CVE-2026-39386 |
high | 8.8 | 0.0044 | 2026-04-21 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 throug | |
CVE-2026-33318 |
high | 8.8 | 0.0047 | 2026-04-24 | Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (incl | |
CVE-2026-32658 |
high | 8.8 | 0.0024 | 2026-05-11 | Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability. | |
CVE-2026-6506 |
high | 8.8 | 0.0029 | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, | |
CVE-2026-46414 |
high | 8.8 | 0.0059 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-49357 |
high | 8.8 | 0.0056 | 2026-06-19 | Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows | |
CVE-2026-56038 |
high | 8.8 | 0.0042 | 2026-06-26 | Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions. | |
CVE-2026-14460 |
high | 8.8 | 0.0016 | 2026-07-03 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardu | |
CVE-2026-57830 |
high | 8.8 | 0.0050 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2. | |
CVE-2026-63829 |
high | 8.8 | 0.0015 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_AD | |
CVE-2026-63941 |
high | 8.8 | 0.0015 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Correctly cap ZCR_E | |
CVE-2026-47405 |
high | 8.8 | 0.0036 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-49258 |
high | 8.8 | 0.0048 | 2026-07-28 | Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and belo | |
CVE-2026-50622 |
high | 8.8 | 0.0058 | 2026-07-29 | Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache | |
CVE-2026-58080 |
high | 8.8 | 0.0038 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configu | |
CVE-2026-17070 |
high | 8.8 | 0.0042 | 2026-08-04 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Pr | |
CVE-2026-18650 |
high | 8.8 | 0.0042 | 2026-08-04 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This is | |
CVE-2026-48169 |
high | 8.8 | 0.0044 | 2026-08-07 | PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have | |
CVE-2026-58243 |
high | 8.8 | 0.0044 | 2026-08-11 | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality | |
CVE-2026-9771 |
high | 8.8 | 0.0014 | 2026-08-17 | The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On bu | |
CVE-2026-116165 |
high | 8.8 | 0.0032 | 2026-10-25 | Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnera | |
CVE-2026-110196 |
high | 8.8 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authentica | |
CVE-2026-114387 |
high | 8.7 | 0.0032 | 2026-10-21 | Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-pan | |
CVE-2026-93639 |
high | 8.7 | 0.0037 | 2026-10-23 | A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated adminis | |
CVE-2026-112355 |
high | 8.7 | 0.0027 | 2026-10-27 | The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerabilit | |
CVE-2026-34046 |
high | 8.7 | 0.0048 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5. | |
CVE-2026-22683 |
high | 8.7 | 0.0261 | 2026-04-07 | Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows u | |
CVE-2026-40502 |
high | 8.7 | 0.0169 | 2026-04-16 | OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote ga | |
CVE-2026-56115 |
high | 8.7 | 0.0045 | 2026-06-23 | Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low | |
CVE-2026-45677 |
high | 8.7 | 0.0068 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-56767 |
high | 8.7 | 0.0060 | 2026-06-25 | Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storag | |
CVE-2026-56768 |
high | 8.7 | 0.0071 | 2026-06-25 | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-tas | |
CVE-2026-56773 |
high | 8.7 | 0.0054 | 2026-06-26 | Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenti | |
CVE-2026-58165 |
high | 8.7 | 0.0034 | 2026-06-30 | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that | |
CVE-2026-59708 |
high | 8.7 | 0.0059 | 2026-07-07 | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without | |
CVE-2026-12593 |
high | 8.7 | 0.0043 | 2026-07-09 | The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/ | |
CVE-2026-62328 |
high | 8.7 | 0.0046 | 2026-07-13 | 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that | |
CVE-2026-62233 |
high | 8.7 | 0.0044 | 2026-07-17 | grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and | |
CVE-2026-65007 |
high | 8.7 | 0.0033 | 2026-07-21 | The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation an | |
CVE-2026-47394 |
high | 8.7 | 0.0050 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / | |
CVE-2026-66027 |
high | 8.7 | 0.0046 | 2026-07-24 | Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that all | |
CVE-2026-70619 |
high | 8.7 | 0.0066 | 2026-08-04 | Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authentica | |
CVE-2026-70636 |
high | 8.7 | 0.0066 | 2026-08-06 | Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated at | |
CVE-2026-71962 |
high | 8.7 | 0.0068 | 2026-08-10 | Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/ | |
CVE-2026-74904 |
high | 8.7 | 0.0045 | 2026-08-18 | SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kerne | |
CVE-2026-75836 |
high | 8.7 | 0.0047 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.1 |