Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-19350 |
medium | 5.3 | 0.0026 | 2026-08-09 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the fi | |
CVE-2026-18698 |
medium | 5.3 | 0.0024 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to | |
CVE-2026-73221 |
medium | 5.3 | 0.0043 | 2026-08-11 | CVAT is an open source interactive video and image annotation tool for computer vision. From 2.17.0 | |
CVE-2026-109287 |
medium | 5.3 | 0.0028 | 2026-10-12 | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file lis | |
CVE-2026-109336 |
medium | 5.3 | 0.0022 | 2026-10-12 | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to re | |
CVE-2026-109376 |
medium | 5.3 | 0.0025 | 2026-10-12 | ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timeshe | |
CVE-2026-84284 |
medium | 5.3 | 0.0022 | 2026-10-13 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, 19.3 | |
CVE-2026-74032 |
medium | 5.3 | 0.0033 | 2026-10-13 | Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privil | |
CVE-2026-112268 |
medium | 5.3 | 0.0032 | 2026-10-19 | sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that | |
CVE-2026-84920 |
medium | 5.3 | 0.0029 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsin | |
CVE-2026-96356 |
medium | 5.3 | 0.0041 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects | |
CVE-2026-96366 |
medium | 5.3 | 0.0040 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects | |
CVE-2026-113876 |
medium | 5.3 | 0.0029 | 2026-10-22 | SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user wit | |
CVE-2026-115370 |
medium | 5.3 | 0.0037 | 2026-10-22 | Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a restriction bypass | |
CVE-2026-75525 |
medium | 5.3 | 0.0012 | 2026-10-23 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-116020 |
medium | 5.3 | 0.0018 | 2026-10-24 | BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController t | |
CVE-2026-56775 |
medium | 5.3 | 0.0030 | 2026-07-08 | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating ev | |
CVE-2026-56776 |
medium | 5.3 | 0.0028 | 2026-07-08 | n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{wor | |
CVE-2026-105206 |
medium | 5.3 | 0.0028 | 2026-10-04 | ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the U | |
CVE-2026-21031 |
medium | 5.2 | 0.0009 | 2026-06-05 | Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch a | |
CVE-2026-49983 |
medium | 5.2 | 0.0014 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.8.1, environment access is gat | |
CVE-2026-118642 |
medium | 5.1 | 0.0021 | 2026-10-28 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows a | |
CVE-2026-118675 |
medium | 5.1 | 0.0017 | 2026-10-28 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows | |
CVE-2026-118676 |
medium | 5.1 | 0.0020 | 2026-10-28 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows m | |
CVE-2026-65594 |
medium | 5.1 | 0.0044 | 2026-07-22 | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and tok | |
CVE-2026-65596 |
medium | 5.1 | 0.0037 | 2026-07-22 | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restrict | |
CVE-2026-63142 |
medium | 5.0 | 0.0029 | 2026-07-21 | Incomplete List of Disallowed Inputs (CWE-184) in Kibana can allow an authenticated attacker with ac | |
CVE-2026-71201 |
medium | 5.0 | 0.0028 | 2026-08-05 | In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can retu | |
CVE-2026-101491 |
medium | 5.0 | 0.0027 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Quer | |
CVE-2026-114473 |
medium | 5.0 | 0.0024 | 2026-10-21 | Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 | |
CVE-2026-18223 |
medium | 5.0 | 0.0016 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-19076 |
medium | 4.9 | 0.0020 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-91263 |
medium | 4.9 | 0.0015 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Noti | |
CVE-2026-26067 |
medium | 4.9 | 0.0025 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server- | |
CVE-2026-41280 |
medium | 4.9 | 0.0044 | 2026-06-17 | Incorrect Authorization vulnerability allows users with system login privileges to delete task defin | |
CVE-2026-57218 |
medium | 4.9 | 0.0035 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing | |
CVE-2026-112219 |
medium | 4.9 | 0.0033 | 2026-10-23 | The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the lis | |
CVE-2026-13237 |
medium | 4.8 | 0.0022 | 2026-07-10 | Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affec | |
CVE-2026-13238 |
medium | 4.8 | 0.0022 | 2026-07-10 | Incorrect Authorization vulnerability in Drupal Commerce Realex / Global Payments allows Forceful Br | |
CVE-2026-116140 |
medium | 4.8 | 0.0013 | 2026-10-25 | ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which | |
CVE-2026-114619 |
medium | 4.6 | 0.0016 | 2026-10-22 | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImp | |
CVE-2026-21789 |
medium | 4.6 | 0.0012 | 2026-05-18 | HCL Connections contains a broken access control vulnerability that may allow unauthorized user to u | |
CVE-2026-87350 |
medium | 4.5 | 0.0011 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Secu | |
CVE-2026-70280 |
medium | 4.4 | 0.0039 | 2026-10-13 | Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature | |
CVE-2026-87352 |
medium | 4.4 | 0.0013 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP | |
CVE-2026-5383 |
medium | 4.4 | 0.0018 | 2026-04-07 | An issue that could allow access to Explorer groups from outside of the authorized organization scop | |
CVE-2026-35370 |
medium | 4.4 | 0.0011 | 2026-04-22 | The id utility in uutils coreutils miscalculates the groups= section of its output. The implementati | |
CVE-2026-101423 |
medium | 4.3 | 0.0026 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Repo | |
CVE-2026-117472 |
medium | 4.3 | 0.0032 | 2026-10-27 | Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-re | |
CVE-2026-108302 |
medium | 4.3 | 0.0017 | 2026-10-27 | Tanium addressed an improper access controls vulnerability in Comply. |