Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (644)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-48763 |
high | 8.2 | 0.0053 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoi | |
CVE-2026-64954 |
high | 8.2 | 0.0031 | 2026-08-12 | Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule | |
CVE-2026-73356 |
high | 8.2 | 0.0037 | 2026-08-18 | Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions. | |
CVE-2026-56836 |
high | 8.2 | 0.0023 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's | |
CVE-2026-70340 |
high | 8.1 | 0.0080 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a | |
CVE-2026-23708 |
high | 8.1 | 0.0028 | 2026-04-14 | A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR Pa | |
CVE-2026-40581 |
high | 8.1 | 0.0020 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record | |
CVE-2026-49291 |
high | 8.1 | 0.0049 | 2026-06-19 | mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTT | |
CVE-2026-55762 |
high | 8.1 | 0.0047 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8 | |
CVE-2026-54842 |
high | 8.1 | 0.0035 | 2026-06-25 | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configu | |
CVE-2026-57645 |
high | 8.1 | 0.0035 | 2026-06-26 | newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. | |
CVE-2026-59796 |
high | 8.1 | 0.0035 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission | |
CVE-2026-47129 |
high | 8.1 | 0.0027 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 hav | |
CVE-2026-47409 |
high | 8.1 | 0.0034 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-47412 |
high | 8.1 | 0.0053 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior | |
CVE-2026-60953 |
high | 8.1 | 0.0036 | 2026-07-21 | Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite | |
CVE-2026-66375 |
high | 8.1 | 0.0040 | 2026-08-12 | A low-privilege authenticated user may permanently remove protected internal metadata across reposit | |
CVE-2026-28186 |
high | 8.1 | 0.0038 | 2026-08-13 | Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | |
CVE-2026-75051 |
high | 8.1 | 0.0039 | 2026-08-17 | In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was po | |
CVE-2026-71308 |
high | 8.1 | 0.0032 | 2026-08-18 | Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit | |
CVE-2026-114489 |
high | 8.1 | 0.0027 | 2026-10-21 | Missing authorization in the REST and COM administration APIs of Progressive Robot hMailServer 6.0.0 | |
CVE-2026-20155 |
high | 8.0 | 0.0027 | 2026-04-01 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager | |
CVE-2026-83568 |
high | 7.8 | 0.0034 | 2026-10-13 | Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate priv | |
CVE-2026-100217 |
high | 7.8 | 0.0033 | 2026-10-13 | Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privi | |
CVE-2026-102233 |
high | 7.8 | 0.0043 | 2026-10-13 | Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security fea | |
CVE-2026-83583 |
high | 7.8 | 0.0035 | 2026-10-13 | Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges | |
CVE-2026-88135 |
high | 7.8 | 0.0032 | 2026-10-13 | Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. | |
CVE-2026-42851 |
high | 7.8 | 0.0016 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write b | |
CVE-2026-0133 |
high | 7.8 | 0.0007 | 2026-06-16 | In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootc | |
CVE-2026-6509 |
high | 7.8 | 0.0014 | 2026-07-05 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardu | |
CVE-2026-20495 |
high | 7.8 | 0.0015 | 2026-08-03 | In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This c | |
CVE-2026-116896 |
high | 7.7 | 0.0022 | 2026-10-27 | REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that | |
CVE-2026-83947 |
high | 7.7 | 0.0053 | 2026-10-08 | Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a n | |
CVE-2026-41266 |
high | 7.7 | 0.0406 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-43885 |
high | 7.7 | 0.0034 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticat | |
CVE-2026-54322 |
high | 7.7 | 0.0030 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-58168 |
high | 7.7 | 0.0041 | 2026-06-30 | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privi | |
CVE-2026-54329 |
high | 7.7 | 0.0039 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m | |
CVE-2026-14251 |
high | 7.7 | 0.0039 | 2026-07-15 | A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate reso | |
CVE-2026-20483 |
high | 7.7 | 0.0017 | 2026-08-03 | In Telephony, there is a possible escalation of privilege due to a missing permission check. This co | |
CVE-2026-71307 |
high | 7.7 | 0.0031 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/desti | |
CVE-2025-71433 |
high | 7.7 | 0.0057 | 2026-10-14 | Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to | |
CVE-2026-52870 |
high | 7.6 | 0.0039 | 2026-07-15 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MC | |
CVE-2026-55544 |
high | 7.6 | 0.0022 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP c | |
CVE-2026-67527 |
high | 7.6 | 0.0043 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/wo | |
CVE-2024-24844 |
high | 7.5 | 0.0029 | 2025-12-23 | Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Elementor allows Exploiti | |
CVE-2026-116613 |
high | 7.5 | 0.0028 | 2026-10-28 | The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in vers | |
CVE-2026-116393 |
high | 7.5 | 0.0032 | 2026-10-28 | Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploi | |
CVE-2026-118804 |
high | 7.5 | 0.0025 | 2026-10-28 | Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthent | |
CVE-2025-58629 |
high | 7.5 | 0.0038 | 2025-11-06 | Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrec |