Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2025-46175 |
high | 7.5 | 0.0033 | 2025-11-26 | Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permis | |
CVE-2025-66735 |
high | 7.5 | 0.0044 | 2025-12-22 | youlai-boot V2.21.1 is vulnerable to Incorrect Access Control. The getRoleForm function in SysRoleCo | |
CVE-2026-40117 |
high | 7.5 | 0.0034 | 2026-04-09 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py | |
CVE-2026-39816 |
high | 7.5 | 0.0076 | 2026-05-08 | The optional extension component TinkerpopClientService is missing the Restricted annotation with th | |
CVE-2026-33357 |
high | 7.5 | 0.0024 | 2026-05-11 | In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti | |
CVE-2026-33359 |
high | 7.5 | 0.0029 | 2026-05-11 | In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not | |
CVE-2026-8547 |
high | 7.5 | 0.0026 | 2026-05-14 | Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 all | |
CVE-2026-25425 |
high | 7.5 | 0.0037 | 2026-06-15 | Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. | |
CVE-2026-34886 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions. | |
CVE-2026-34898 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. | |
CVE-2026-39503 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions. | |
CVE-2026-39524 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions. | |
CVE-2026-39533 |
high | 7.5 | 0.0030 | 2026-06-15 | Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions. | |
CVE-2026-40741 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions. | |
CVE-2026-40774 |
high | 7.5 | 0.0024 | 2026-06-15 | Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions. | |
CVE-2026-40776 |
high | 7.5 | 0.0041 | 2026-06-15 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions. | |
CVE-2026-42666 |
high | 7.5 | 0.0028 | 2026-06-15 | Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions. | |
CVE-2026-48835 |
high | 7.5 | 0.0031 | 2026-06-15 | Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions. | |
CVE-2026-48873 |
high | 7.5 | 0.0024 | 2026-06-15 | Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions. | |
CVE-2026-48883 |
high | 7.5 | 0.0024 | 2026-06-15 | Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions. | |
CVE-2026-39490 |
high | 7.5 | 0.0031 | 2026-06-16 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. | |
CVE-2026-52711 |
high | 7.5 | 0.0022 | 2026-06-16 | Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. | |
CVE-2026-49057 |
high | 7.5 | 0.0030 | 2026-06-17 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. | |
CVE-2026-54802 |
high | 7.5 | 0.0037 | 2026-06-17 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. | |
CVE-2026-54810 |
high | 7.5 | 0.0024 | 2026-06-17 | Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configu | |
CVE-2026-44914 |
high | 7.5 | 0.0066 | 2026-06-22 | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that includ | |
CVE-2026-27366 |
high | 7.5 | 0.0031 | 2026-06-25 | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. | |
CVE-2026-54828 |
high | 7.5 | 0.0035 | 2026-06-25 | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | |
CVE-2026-54830 |
high | 7.5 | 0.0035 | 2026-06-25 | Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions. | |
CVE-2026-54844 |
high | 7.5 | 0.0035 | 2026-06-25 | Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions. | |
CVE-2026-57921 |
high | 7.5 | 0.0030 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private dat | |
CVE-2026-57923 |
high | 7.5 | 0.0027 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint | |
CVE-2026-54832 |
high | 7.5 | 0.0035 | 2026-06-26 | Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. | |
CVE-2026-54835 |
high | 7.5 | 0.0035 | 2026-06-26 | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. | |
CVE-2026-54837 |
high | 7.5 | 0.0039 | 2026-06-26 | Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= | |
CVE-2026-54846 |
high | 7.5 | 0.0039 | 2026-06-26 | Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versi | |
CVE-2026-54847 |
high | 7.5 | 0.0039 | 2026-06-26 | Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions. | |
CVE-2026-56025 |
high | 7.5 | 0.0035 | 2026-06-26 | Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions. | |
CVE-2026-56061 |
high | 7.5 | 0.0035 | 2026-06-26 | Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions. | |
CVE-2026-47193 |
high | 7.5 | 0.0031 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j | |
CVE-2026-39448 |
high | 7.5 | 0.0035 | 2026-07-02 | Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. | |
CVE-2026-25038 |
high | 7.5 | 0.0062 | 2026-07-03 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. | |
CVE-2026-57378 |
high | 7.5 | 0.0035 | 2026-07-13 | Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting In | |
CVE-2026-57705 |
high | 7.5 | 0.0035 | 2026-07-13 | Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorre | |
CVE-2026-57727 |
high | 7.5 | 0.0039 | 2026-07-13 | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured | |
CVE-2026-57729 |
high | 7.5 | 0.0039 | 2026-07-13 | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Con | |
CVE-2026-59547 |
high | 7.5 | 0.0035 | 2026-07-23 | Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions | |
CVE-2026-61943 |
high | 7.5 | 0.0039 | 2026-07-23 | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. | |
CVE-2026-61954 |
high | 7.5 | 0.0035 | 2026-07-23 | Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. | |
CVE-2026-65495 |
high | 7.5 | 0.0043 | 2026-07-23 | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. |