Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-75853 |
high | 8.7 | 0.0059 | 2026-08-18 | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforc | |
CVE-2026-53453 |
high | 8.7 | 0.0045 | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5. | |
CVE-2026-74034 |
high | 8.7 | 0.0043 | 2026-10-13 | Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrol | |
CVE-2026-110215 |
high | 8.7 | 0.0047 | 2026-10-13 | youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated | |
CVE-2026-76066 |
high | 8.7 | 0.0044 | 2026-10-15 | IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability whe | |
CVE-2026-105937 |
high | 8.7 | 0.0024 | 2026-10-21 | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic fro | |
CVE-2026-109431 |
high | 8.6 | 0.0036 | 2026-10-19 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulne | |
CVE-2026-114354 |
high | 8.6 | 0.0013 | 2026-10-23 | Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in D | |
CVE-2026-8077 |
high | 8.6 | 0.0031 | 2026-05-08 | Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01 | |
CVE-2026-34024 |
high | 8.6 | 0.0030 | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorizatio | |
CVE-2026-22343 |
high | 8.6 | 0.0026 | 2026-06-17 | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. | |
CVE-2026-54415 |
high | 8.6 | 0.0035 | 2026-06-17 | Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS befo | |
CVE-2026-11719 |
high | 8.6 | 0.0014 | 2026-06-18 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missi | |
CVE-2026-55638 |
high | 8.6 | 0.0658 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and / | |
CVE-2026-57206 |
high | 8.6 | 0.0096 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-g | |
CVE-2026-64814 |
high | 8.6 | 0.0039 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Developme | |
CVE-2026-19539 |
high | 8.6 | 0.0044 | 2026-08-11 | Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospe | |
CVE-2026-63174 |
high | 8.6 | 0.0025 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a | |
CVE-2026-114519 |
high | 8.6 | 0.0036 | 2026-10-22 | Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 | |
CVE-2026-119129 |
high | 8.6 | — | 2026-10-29 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability | |
CVE-2026-59185 |
high | 8.5 | 0.0032 | 2026-10-28 | identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0 | |
CVE-2026-12715 |
high | 8.5 | 0.0035 | 2026-07-17 | Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud P | |
CVE-2026-67344 |
high | 8.5 | 0.0024 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... | |
CVE-2026-70178 |
high | 8.5 | 0.0063 | 2026-09-03 | Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a | |
CVE-2026-70386 |
high | 8.5 | 0.0122 | 2026-10-21 | Improper neutralization of special elements used in an OS command ('OS command injection') and Missi | |
CVE-2026-11858 |
high | 8.4 | 0.0013 | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Upda | |
CVE-2026-56835 |
high | 8.3 | 0.0022 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's S | |
CVE-2026-85299 |
high | 8.3 | 0.0026 | 2026-10-27 | A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot API | |
CVE-2026-59979 |
high | 8.3 | 0.0029 | 2026-10-28 | YosemiteCrew provides organization-based service and task management. In the source-reported affecte | |
CVE-2026-116794 |
high | 8.3 | 0.0016 | 2026-10-28 | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Fr | |
CVE-2026-35438 |
high | 8.3 | 0.0056 | 2026-05-12 | Missing authorization in Windows Admin Center allows an authorized attacker to elevate privileges ov | |
CVE-2026-46558 |
high | 8.3 | 0.0029 | 2026-06-10 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace | |
CVE-2026-56063 |
high | 8.3 | 0.0030 | 2026-06-26 | Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions. | |
CVE-2026-11340 |
high | 8.3 | 0.0035 | 2026-07-07 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Pr | |
CVE-2026-70473 |
high | 8.3 | 0.0045 | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. | |
CVE-2026-111638 |
high | 8.3 | 0.0040 | 2026-10-16 | sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key | |
CVE-2026-39432 |
high | 8.2 | 0.0024 | 2026-05-12 | Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured A | |
CVE-2026-42664 |
high | 8.2 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce S | |
CVE-2026-49065 |
high | 8.2 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions. | |
CVE-2026-40726 |
high | 8.2 | 0.0024 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. | |
CVE-2026-49081 |
high | 8.2 | 0.0029 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. | |
CVE-2026-57688 |
high | 8.2 | 0.0039 | 2026-07-02 | Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions. | |
CVE-2026-27771 |
high | 8.2 | 0.0139 | 2026-07-03 | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package s | |
CVE-2026-8377 |
high | 8.2 | 0.0034 | 2026-07-07 | Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control Syste | |
CVE-2026-14504 |
high | 8.2 | 0.0037 | 2026-07-14 | An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/b | |
CVE-2026-65895 |
high | 8.2 | 0.0029 | 2026-07-23 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin con | |
CVE-2026-71252 |
high | 8.2 | 0.0051 | 2026-08-05 | toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, | |
CVE-2026-71264 |
high | 8.2 | 0.0033 | 2026-08-05 | WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no setting | |
CVE-2026-66708 |
high | 8.2 | 0.0037 | 2026-08-06 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | |
CVE-2026-14886 |
high | 8.2 | 0.0033 | 2026-08-10 | Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authoriz |