Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (848)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-62186 |
high | 7.2 | 0.0033 | 2026-07-13 | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible | |
CVE-2026-65916 |
high | 7.2 | 0.0049 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in | |
CVE-2026-69252 |
high | 7.2 | 0.0054 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-67621 |
high | 7.2 | 0.0042 | 2026-08-06 | Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated works | |
CVE-2026-73326 |
high | 7.2 | 0.0038 | 2026-08-12 | CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privile | |
CVE-2026-112000 |
high | 7.2 | 0.0029 | 2026-10-18 | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows | |
CVE-2026-114082 |
high | 7.2 | 0.0034 | 2026-10-21 | Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders wi | |
CVE-2026-105934 |
high | 7.2 | 0.0048 | 2026-10-21 | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE | |
CVE-2026-116208 |
high | 7.2 | 0.0024 | 2026-10-25 | YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService | |
CVE-2026-72825 |
high | 7.2 | 0.0035 | 2026-08-14 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /r | |
CVE-2026-25716 |
high | 7.1 | 0.0018 | 2026-10-23 | Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) a | |
CVE-2026-116876 |
high | 7.1 | 0.0024 | 2026-10-27 | Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that all | |
CVE-2026-116897 |
high | 7.1 | 0.0021 | 2026-10-27 | REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version an | |
CVE-2026-110540 |
high | 7.1 | 0.0032 | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS20 | |
CVE-2026-52729 |
high | 7.1 | 0.0029 | 2026-10-28 | Xibo is an open source digital signage platform with a web content management system and Windows dis | |
CVE-2026-59164 |
high | 7.1 | 0.0020 | 2026-10-28 | NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` auth | |
CVE-2026-65675 |
high | 7.1 | 0.0064 | 2026-08-11 | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker t | |
CVE-2026-34256 |
high | 7.1 | 0.0022 | 2026-04-14 | Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an a | |
CVE-2026-40480 |
high | 7.1 | 0.0040 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/perso | |
CVE-2026-41192 |
high | 7.1 | 0.0024 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply an | |
CVE-2026-6834 |
high | 7.1 | 0.0026 | 2026-04-22 | The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated rem | |
CVE-2026-44010 |
high | 7.1 | 0.0041 | 2026-05-12 | Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, the GraphQL | |
CVE-2026-44012 |
high | 7.1 | 0.0034 | 2026-05-12 | Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::a | |
CVE-2026-47120 |
high | 7.1 | 0.0031 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-48119 |
high | 7.1 | 0.0031 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-5230 |
high | 7.1 | 0.0017 | 2026-06-15 | Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library al | |
CVE-2026-40788 |
high | 7.1 | 0.0031 | 2026-06-15 | Subscriber Broken Access Control in ChatBot <= 7.9.7 versions. | |
CVE-2026-52866 |
high | 7.1 | 0.0035 | 2026-06-19 | An attacker within BLE communication range can monopolize the device's only available BLE connectio | |
CVE-2026-56280 |
high | 7.1 | 0.0032 | 2026-06-22 | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that a | |
CVE-2026-56402 |
high | 7.1 | 0.0038 | 2026-06-23 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse | |
CVE-2026-56695 |
high | 7.1 | 0.0040 | 2026-06-23 | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allow | |
CVE-2026-57520 |
high | 7.1 | 0.0064 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authentic | |
CVE-2026-57332 |
high | 7.1 | 0.0034 | 2026-06-29 | Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions. | |
CVE-2026-57949 |
high | 7.1 | 0.0029 | 2026-06-29 | ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerabili | |
CVE-2026-58167 |
high | 7.1 | 0.0042 | 2026-06-30 | Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext da | |
CVE-2026-58176 |
high | 7.1 | 0.0032 | 2026-06-30 | RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints un | |
CVE-2026-58448 |
high | 7.1 | 0.0040 | 2026-06-30 | yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that all | |
CVE-2026-50284 |
high | 7.1 | 0.0039 | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 t | |
CVE-2026-57746 |
high | 7.1 | 0.0029 | 2026-07-02 | Subscriber Broken Access Control in Booked <= 3.0.0 versions. | |
CVE-2026-59262 |
high | 7.1 | 0.0042 | 2026-07-08 | AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit | |
CVE-2026-59805 |
high | 7.1 | 0.0039 | 2026-07-08 | Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesControlle | |
CVE-2026-54005 |
high | 7.1 | 0.0043 | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a rol | |
CVE-2026-61441 |
high | 7.1 | 0.0029 | 2026-07-10 | PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue depende | |
CVE-2026-61442 |
high | 7.1 | 0.0031 | 2026-07-11 | PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on t | |
CVE-2026-57405 |
high | 7.1 | 0.0032 | 2026-07-13 | Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly C | |
CVE-2026-57740 |
high | 7.1 | 0.0032 | 2026-07-13 | Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymail | |
CVE-2026-58410 |
high | 7.1 | 0.0021 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authoriza | |
CVE-2026-62191 |
high | 7.1 | 0.0036 | 2026-07-13 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message | |
CVE-2026-61440 |
high | 7.1 | 0.0026 | 2026-07-15 | PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowin | |
CVE-2026-59255 |
high | 7.1 | 0.0044 | 2026-07-15 | BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in |