Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-35596 |
medium | 4.3 | 0.0027 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the hasAccessToLabel | |
CVE-2026-24176 |
medium | 4.3 | 0.0019 | 2026-04-21 | NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization t | |
CVE-2026-42884 |
medium | 4.3 | 0.0020 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/collecti | |
CVE-2026-44374 |
medium | 4.3 | 0.0017 | 2026-05-14 | Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed enti | |
CVE-2026-9791 |
medium | 4.3 | 0.0022 | 2026-05-28 | A flaw was found in Keycloak. An authenticated user with existing organization membership can exploi | |
CVE-2026-44169 |
medium | 4.3 | 0.0024 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11 | |
CVE-2026-12446 |
medium | 4.3 | 0.0019 | 2026-06-17 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote | |
CVE-2026-49288 |
medium | 4.3 | 0.0027 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, | |
CVE-2026-27761 |
medium | 4.3 | 0.0045 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow repository RSS and Atom feed endpoints to bypass API | |
CVE-2026-58209 |
medium | 4.3 | 0.0034 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr | |
CVE-2026-58214 |
medium | 4.3 | 0.0035 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr | |
CVE-2026-55472 |
medium | 4.3 | 0.0033 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, when Full Multiple Companies Supp | |
CVE-2026-55462 |
medium | 4.3 | 0.0034 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UsersController::show() and print | |
CVE-2026-49092 |
medium | 4.3 | 0.0028 | 2026-07-21 | Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized in | |
CVE-2026-63145 |
medium | 4.3 | 0.0027 | 2026-07-21 | Incorrect Authorization (CWE-863) in Kibana can lead to integrity compromise of Machine Learning aud | |
CVE-2026-67528 |
medium | 4.3 | 0.0036 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/cust | |
CVE-2026-68755 |
medium | 4.3 | 0.0026 | 2026-08-12 | A bundle writer may create misleading release promotion information under specific conditions. | |
CVE-2026-63295 |
medium | 4.3 | 0.0035 | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-leve | |
CVE-2026-70657 |
medium | 4.3 | 0.0033 | 2026-08-18 | Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks director | |
CVE-2026-106461 |
medium | 4.3 | 0.0019 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin | |
CVE-2026-110287 |
medium | 4.3 | 0.0019 | 2026-10-16 | Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allow | |
CVE-2026-101489 |
medium | 4.3 | 0.0027 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Port | |
CVE-2026-96398 |
medium | 4.3 | 0.0032 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects | |
CVE-2026-115712 |
medium | 4.3 | — | 2026-10-29 | Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modific | |
CVE-2026-85330 |
medium | 4.3 | — | 2026-10-29 | Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a se | |
CVE-2026-18256 |
medium | 4.3 | 0.0016 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-102260 |
medium | 4.3 | — | 2026-10-29 | HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in sev | |
CVE-2026-83766 |
medium | 4.2 | 0.0041 | 2026-10-13 | Incorrect authorization in Windows Hyper-V allows an authorized attacker to bypass a security featur | |
CVE-2026-46730 |
medium | 4.2 | 0.0017 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-18348 |
medium | 4.1 | 0.0034 | 2026-08-11 | Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an a | |
CVE-2026-71381 |
medium | 4.0 | 0.0027 | 2026-08-07 | Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulner | |
CVE-2026-111032 |
low | 3.8 | 0.0019 | 2026-10-28 | The Welcart e-Commerce WordPress plugin before 2.12.6 does not properly verify authorization against | |
CVE-2026-45692 |
low | 3.8 | 0.0024 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the author | |
CVE-2026-110537 |
low | 3.8 | 0.0024 | 2026-10-23 | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administra | |
CVE-2026-93846 |
low | 3.8 | 0.0015 | 2026-10-26 | Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a tea | |
CVE-2026-47086 |
low | 3.5 | 0.0027 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can by | |
CVE-2026-54244 |
low | 3.5 | 0.0030 | 2026-07-17 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, t | |
CVE-2026-96384 |
low | 3.5 | 0.0020 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This | |
CVE-2026-93847 |
low | 3.5 | 0.0017 | 2026-10-26 | Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled p | |
CVE-2026-28864 |
low | 3.3 | 0.0018 | 2026-03-25 | This issue was addressed with improved permissions checking. This issue is fixed in iOS 18.7.7 and i | |
CVE-2026-29179 |
low | 3.3 | 0.0014 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grai | |
CVE-2026-87096 |
low | 3.3 | 0.0013 | 2026-10-21 | Sensitive information disclosure and manipulation due to improper authorization checks. The followin | |
CVE-2026-96373 |
low | 3.3 | 0.0023 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects | |
CVE-2026-13232 |
low | 3.1 | 0.0021 | 2026-07-10 | Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allow | |
CVE-2026-47081 |
low | 3.1 | 0.0024 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE f | |
CVE-2026-114721 |
low | 3.1 | 0.0030 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration set | |
CVE-2026-5379 |
low | 3.0 | 0.0012 | 2026-04-07 | An issue that allowed MCP agents to access certificate information from outside of their authorized | |
CVE-2026-5382 |
low | 3.0 | 0.0017 | 2026-04-07 | An issue that could expose records outside of the authorized organization scope through the MCP endp | |
CVE-2026-48074 |
low | 2.7 | 0.0029 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-103515 |
low | 2.7 | 0.0023 | 2026-10-22 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 before 19.3.6, 19.4 bef |