Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1099)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65500 |
high | 7.5 | 0.0039 | 2026-07-23 | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPres | |
CVE-2026-59529 |
high | 7.5 | 0.0039 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | |
CVE-2026-59530 |
high | 7.5 | 0.0035 | 2026-07-27 | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | |
CVE-2026-59534 |
high | 7.5 | 0.0035 | 2026-07-27 | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | |
CVE-2026-59536 |
high | 7.5 | 0.0035 | 2026-07-27 | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | |
CVE-2026-66473 |
high | 7.5 | 0.0035 | 2026-07-27 | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | |
CVE-2026-54719 |
high | 7.5 | 0.0035 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, th | |
CVE-2026-65551 |
high | 7.5 | 0.0039 | 2026-08-06 | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Ac | |
CVE-2026-28140 |
high | 7.5 | 0.0035 | 2026-08-06 | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. | |
CVE-2026-65504 |
high | 7.5 | 0.0039 | 2026-08-06 | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. | |
CVE-2026-66712 |
high | 7.5 | 0.0035 | 2026-08-06 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | |
CVE-2026-72692 |
high | 7.5 | 0.0044 | 2026-08-10 | A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauth | |
CVE-2026-73249 |
high | 7.5 | 0.0044 | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update | |
CVE-2026-27345 |
high | 7.5 | 0.0035 | 2026-08-13 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. | |
CVE-2026-61984 |
high | 7.5 | 0.0039 | 2026-08-13 | Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | |
CVE-2026-66431 |
high | 7.5 | 0.0035 | 2026-08-13 | Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLIN | |
CVE-2026-66441 |
high | 7.5 | 0.0039 | 2026-08-13 | Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions. | |
CVE-2026-66466 |
high | 7.5 | 0.0035 | 2026-08-13 | Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Up | |
CVE-2026-66469 |
high | 7.5 | 0.0035 | 2026-08-13 | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | |
CVE-2026-11801 |
high | 7.5 | 0.0164 | 2026-08-18 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all | |
CVE-2026-28567 |
high | 7.5 | 0.0039 | 2026-08-18 | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | |
CVE-2026-28571 |
high | 7.5 | 0.0039 | 2026-08-18 | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. | |
CVE-2026-32472 |
high | 7.5 | 0.0039 | 2026-08-18 | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions. | |
CVE-2026-32549 |
high | 7.5 | 0.0039 | 2026-08-18 | Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | |
CVE-2026-73377 |
high | 7.5 | 0.0035 | 2026-08-18 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | |
CVE-2026-73994 |
high | 7.5 | 0.0035 | 2026-08-18 | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | |
CVE-2026-112312 |
high | 7.5 | 0.0034 | 2026-10-22 | Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Inco | |
CVE-2026-112359 |
high | 7.5 | 0.0032 | 2026-10-23 | Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrect | |
CVE-2026-114191 |
high | 7.5 | 0.0034 | 2026-10-24 | Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-c | |
CVE-2026-105765 |
high | 7.5 | 0.0024 | 2026-10-26 | HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass | |
CVE-2026-114193 |
high | 7.5 | — | 2026-10-29 | Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting In | |
CVE-2026-115599 |
high | 7.5 | — | 2026-10-29 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly | |
CVE-2026-118759 |
high | 7.5 | — | 2026-10-29 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. | |
CVE-2026-110732 |
high | 7.5 | — | 2026-10-30 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to | |
CVE-2026-61571 |
high | 7.3 | 0.0028 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer | |
CVE-2026-42377 |
high | 7.3 | 0.0023 | 2026-04-29 | Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly | |
CVE-2026-42753 |
high | 7.3 | 0.0018 | 2026-05-27 | Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Ex | |
CVE-2026-40775 |
high | 7.3 | 0.0022 | 2026-06-15 | Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions. | |
CVE-2026-54840 |
high | 7.3 | 0.0030 | 2026-06-26 | Unauthenticated Broken Access Control in Newsletters <= 4.13 versions. | |
CVE-2026-61267 |
high | 7.3 | 0.0031 | 2026-07-21 | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (componen | |
CVE-2026-59535 |
high | 7.3 | 0.0030 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | |
CVE-2026-65541 |
high | 7.3 | 0.0030 | 2026-08-06 | Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. | |
CVE-2026-44764 |
high | 7.3 | 0.0032 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence | |
CVE-2026-44765 |
high | 7.3 | 0.0038 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence | |
CVE-2026-53996 |
high | 7.3 | 0.0013 | 2026-08-12 | NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerabil | |
CVE-2026-28188 |
high | 7.3 | 0.0030 | 2026-08-13 | Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. | |
CVE-2026-40623 |
high | 7.2 | 0.0032 | 2026-04-24 | A vulnerability in SenseLive X3050's web management interface allows critical system and network con | |
CVE-2026-47163 |
high | 7.2 | 0.0027 | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to | |
CVE-2026-47197 |
high | 7.2 | 0.0029 | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discor | |
CVE-2026-50007 |
high | 7.2 | 0.0031 | 2026-07-07 | Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issu |