Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1854)
CWE-416 (1298)
CWE-862 (1188)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (849)
CWE-306 (840)
CWE-122 (831)
CWE-20 (798)
CWE-78 (712)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-63100 |
high | 7.1 | 0.0035 | 2026-07-17 | Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-pri | |
CVE-2026-63833 |
high | 7.1 | 0.0014 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: reject direct userspace | |
CVE-2026-55550 |
high | 7.1 | 0.0023 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is a | |
CVE-2026-57494 |
high | 7.1 | 0.0027 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to ver | |
CVE-2026-65050 |
high | 7.1 | 0.0044 | 2026-07-21 | Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability | |
CVE-2026-57367 |
high | 7.1 | 0.0034 | 2026-07-23 | Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. | |
CVE-2026-13229 |
high | 7.1 | 0.0043 | 2026-08-04 | Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article at | |
CVE-2026-70475 |
high | 7.1 | 0.0046 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-13227 |
high | 7.1 | 0.0031 | 2026-08-04 | An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to in | |
CVE-2026-65554 |
high | 7.1 | 0.0034 | 2026-08-06 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. | |
CVE-2026-66470 |
high | 7.1 | 0.0032 | 2026-08-06 | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. | |
CVE-2026-18277 |
high | 7.1 | 0.0041 | 2026-08-06 | Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 2 | |
CVE-2026-66060 |
high | 7.1 | 0.0017 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior | |
CVE-2026-66061 |
high | 7.1 | 0.0017 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior | |
CVE-2026-72910 |
high | 7.1 | 0.0050 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, | |
CVE-2026-42142 |
high | 7.1 | 0.0037 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST | |
CVE-2026-48495 |
high | 7.1 | 0.0035 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes | |
CVE-2026-18704 |
high | 7.1 | 0.0029 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read | |
CVE-2026-69115 |
high | 7.1 | 0.0030 | 2026-08-11 | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated us | |
CVE-2026-27535 |
high | 7.1 | 0.0032 | 2026-08-13 | Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | |
CVE-2026-28173 |
high | 7.1 | 0.0032 | 2026-08-13 | Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. | |
CVE-2026-75109 |
high | 7.1 | 0.0029 | 2026-08-17 | Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the | |
CVE-2026-75846 |
high | 7.1 | 0.0035 | 2026-08-18 | ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability | |
CVE-2026-109427 |
high | 7.1 | 0.0021 | 2026-10-12 | Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allow | |
CVE-2026-110117 |
high | 7.1 | 0.0028 | 2026-10-13 | SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController t | |
CVE-2026-63172 |
high | 7.1 | 0.0021 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a | |
CVE-2026-104948 |
high | 7.1 | 0.0022 | 2026-10-21 | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authoriza | |
CVE-2026-93336 |
high | 7.1 | 0.0022 | 2026-10-22 | Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allo | |
CVE-2026-115975 |
high | 7.1 | 0.0022 | 2026-10-24 | Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to cr | |
CVE-2026-116492 |
high | 7.1 | 0.0024 | 2026-10-26 | Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticate | |
CVE-2026-112827 |
high | 7.1 | — | 2026-10-29 | Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce h | |
CVE-2026-115963 |
high | 7.1 | — | 2026-10-29 | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-strea | |
CVE-2026-114356 |
high | 7.0 | 0.0012 | 2026-10-23 | Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C fi | |
CVE-2026-66723 |
high | 7.0 | 0.0083 | 2026-07-29 | MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote I | |
CVE-2026-115373 |
high | 7.0 | 0.0021 | 2026-10-22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vuln | |
CVE-2026-114388 |
medium | 6.9 | 0.0017 | 2026-10-21 | Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control | |
CVE-2026-114267 |
medium | 6.9 | 0.0031 | 2026-10-21 | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unkn | |
CVE-2026-115323 |
medium | 6.9 | 0.0024 | 2026-10-22 | EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address A | |
CVE-2026-116873 |
medium | 6.9 | 0.0019 | 2026-10-27 | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smw | |
CVE-2026-116879 |
medium | 6.9 | 0.0021 | 2026-10-27 | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smw | |
CVE-2026-116890 |
medium | 6.9 | 0.0019 | 2026-10-27 | Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api | |
CVE-2026-118754 |
medium | 6.9 | 0.0024 | 2026-10-28 | Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recru | |
CVE-2026-118757 |
medium | 6.9 | 0.0023 | 2026-10-28 | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing au | |
CVE-2026-22680 |
medium | 6.9 | 0.0038 | 2026-04-07 | OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling | |
CVE-2026-8934 |
medium | 6.9 | 0.0051 | 2026-06-22 | A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine se | |
CVE-2026-59097 |
medium | 6.9 | 0.0043 | 2026-07-02 | Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remot | |
CVE-2026-15541 |
medium | 6.9 | 0.0054 | 2026-07-13 | A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server. | |
CVE-2026-60118 |
medium | 6.9 | 0.0030 | 2026-07-14 | Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that all | |
CVE-2026-65055 |
medium | 6.9 | 0.0033 | 2026-07-21 | Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to | |
CVE-2026-68585 |
medium | 6.9 | 0.0024 | 2026-08-03 | SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlock |