Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-69555 |
critical | 10.0 | 0.0080 | 2026-08-20 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a ne | |
CVE-2026-42160 |
critical | 10.0 | 0.0032 | 2026-05-08 | Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dat | |
CVE-2026-48772 |
critical | 10.0 | 0.0023 | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. In versions 2.0.0 through 3.0.8, | |
CVE-2026-48286 |
critical | 10.0 | 0.0117 | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth | |
CVE-2026-27302 |
critical | 10.0 | 0.0117 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-71398 |
critical | 10.0 | 0.0117 | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-90532 |
critical | 10.0 | 0.0083 | 2026-10-13 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result i | |
CVE-2026-71195 |
critical | 9.9 | 0.0048 | 2026-10-21 | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify tha | |
CVE-2026-110720 |
critical | 9.9 | 0.0037 | 2026-10-26 | Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in com | |
CVE-2026-105780 |
critical | 9.9 | 0.0049 | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-41050 |
critical | 9.9 | 0.0039 | 2026-05-13 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a | |
CVE-2026-48781 |
critical | 9.9 | 0.0021 | 2026-06-17 | Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration cal | |
CVE-2026-34047 |
critical | 9.9 | 0.0055 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-60663 |
critical | 9.9 | 0.0043 | 2026-07-21 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co | |
CVE-2026-62420 |
critical | 9.9 | 0.0054 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target proje | |
CVE-2026-63296 |
critical | 9.9 | 0.0044 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target proje | |
CVE-2026-63297 |
critical | 9.9 | 0.0034 | 2026-08-12 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allow | |
CVE-2026-55089 |
critical | 9.9 | 0.0046 | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/AP | |
CVE-2026-102649 |
critical | 9.9 | 0.0046 | 2026-10-26 | Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13. | |
CVE-2026-35490 |
critical | 9.8 | 0.0054 | 2026-04-07 | changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login | |
CVE-2026-25293 |
critical | 9.8 | 0.0018 | 2026-05-04 | Buffer overflow due to incorrect authorization in PLC FW | |
CVE-2026-32966 |
critical | 9.8 | 0.0039 | 2026-06-17 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apa | |
CVE-2026-54803 |
critical | 9.8 | 0.0045 | 2026-06-17 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. | |
CVE-2026-7663 |
critical | 9.8 | 0.0052 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p | |
CVE-2026-27780 |
critical | 9.8 | 0.0064 | 2026-07-03 | Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive | |
CVE-2026-15704 |
critical | 9.8 | 0.0046 | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln | |
CVE-2026-48449 |
critical | 9.8 | 0.0086 | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-48333 |
critical | 9.8 | 0.0095 | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu | |
CVE-2026-55518 |
critical | 9.6 | 0.0041 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, | |
CVE-2026-71193 |
critical | 9.6 | 0.0053 | 2026-08-12 | In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the dupl | |
CVE-2026-71424 |
critical | 9.6 | 0.0049 | 2026-08-17 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers | |
CVE-2026-42812 |
critical | 9.4 | 0.0037 | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which data files | |
CVE-2026-42882 |
critical | 9.4 | 0.0055 | 2026-05-11 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentic | |
CVE-2026-63830 |
critical | 9.4 | 0.0044 | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy ac | |
CVE-2026-47407 |
critical | 9.4 | 0.0030 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to versio | |
CVE-2026-25660 |
critical | 9.3 | 0.0045 | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyz | |
CVE-2026-34660 |
critical | 9.3 | 0.0044 | 2026-05-12 | Adobe Connect versions 2025.9.15, 2025.8.157 and earlier are affected by an Incorrect Authorization | |
CVE-2026-18236 |
critical | 9.3 | 0.0022 | 2026-07-29 | A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmat | |
CVE-2026-67341 |
critical | 9.3 | 0.0054 | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL DEFINE FUN | |
CVE-2026-72785 |
critical | 9.3 | 0.0027 | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-pane | |
CVE-2026-73090 |
critical | 9.3 | 0.0040 | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity | |
CVE-2026-13737 |
critical | 9.2 | 0.0067 | 2026-08-11 | CommServe contained an allowlist bypass vulnerability affecting command execution authorization. So | |
CVE-2026-13738 |
critical | 9.2 | 0.0067 | 2026-08-11 | CommServe contained an authorization bypass vulnerability affecting a limited set of command executi | |
CVE-2026-118264 |
critical | 9.1 | 0.0043 | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw | |
CVE-2026-6290 |
critical | 9.1 | 0.0022 | 2026-04-15 | Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows acc | |
CVE-2026-41248 |
critical | 9.1 | 0.0032 | 2026-04-24 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher | |
CVE-2026-42889 |
critical | 9.1 | 0.0037 | 2026-05-12 | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 contain an | |
CVE-2026-32967 |
critical | 9.1 | 0.0034 | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. T | |
CVE-2026-44231 |
critical | 9.1 | 0.0025 | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6 | |
CVE-2026-71362 |
critical | 9.1 | 0.9049 | 2026-08-11 | Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an att | KEV |