Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-110011 |
low | 2.7 | 0.0024 | 2026-10-22 | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capab | |
CVE-2026-88849 |
low | 2.7 | 0.0022 | 2026-10-22 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user tar | |
CVE-2026-101425 |
low | 2.5 | 0.0011 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR) | |
CVE-2026-39957 |
low | 2.3 | 0.0021 | 2026-04-09 | Lychee is a free, open-source photo-management tool. Prior to 7.5.4, a SQL operator-precedence bug i | |
CVE-2026-44911 |
low | 2.3 | 0.0052 | 2026-06-22 | Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 throu | |
CVE-2026-62221 |
low | 2.3 | 0.0024 | 2026-07-17 | OpenClaw 2026.5.12 before 2026.5.26 contain an incorrect authorization vulnerability in the ClickCla | |
CVE-2026-62224 |
low | 2.3 | 0.0026 | 2026-07-17 | OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom | |
CVE-2026-62225 |
low | 2.3 | 0.0025 | 2026-07-17 | OpenClaw versions before 2026.5.18 contain an authorization bypass vulnerability in skill command di | |
CVE-2026-13068 |
low | 2.3 | 0.0025 | 2026-07-22 | An authenticated user holding cursor termination privileges on one database may incorrectly be permi | |
CVE-2026-68980 |
low | 2.3 | 0.0048 | 2026-08-03 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Para | |
CVE-2026-18703 |
low | 2.3 | 0.0014 | 2026-08-11 | An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding u | |
CVE-2026-7485 |
low | 2.3 | 0.0035 | 2026-08-20 | Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all | |
CVE-2026-109561 |
low | 2.3 | 0.0019 | 2026-10-12 | goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to | |
CVE-2026-105927 |
low | 2.3 | 0.0044 | 2026-10-21 | The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy th | |
CVE-2026-105938 |
low | 2.3 | 0.0051 | 2026-10-21 | Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix sub | |
CVE-2026-115509 |
low | 2.3 | 0.0017 | 2026-10-22 | Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/sta | |
CVE-2026-5381 |
low | 2.2 | 0.0017 | 2026-04-07 | An issue that could expose task information outside of the authorized organization scope has been re | |
CVE-2026-12797 |
low | 2.1 | 0.0040 | 2026-06-21 | A security flaw has been discovered in BerriAI litellm up to 1.82.5. Affected is the function async_ | |
CVE-2026-14716 |
low | 2.1 | 0.0040 | 2026-07-05 | A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2. Impacted | |
CVE-2026-15318 |
low | 2.1 | 0.0037 | 2026-07-10 | A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknow | |
CVE-2026-15320 |
low | 2.1 | 0.0040 | 2026-07-10 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function | |
CVE-2026-15332 |
low | 2.1 | 0.0037 | 2026-07-10 | A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unk | |
CVE-2026-15507 |
low | 2.1 | 0.0035 | 2026-07-12 | A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown f | |
CVE-2026-16017 |
low | 2.1 | 0.0037 | 2026-07-17 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/r | |
CVE-2026-16119 |
low | 2.1 | 0.0040 | 2026-07-18 | A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function Request | |
CVE-2026-16123 |
low | 2.1 | 0.0037 | 2026-07-18 | A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is th | |
CVE-2026-16195 |
low | 2.1 | 0.0037 | 2026-07-18 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function | |
CVE-2026-16197 |
low | 2.1 | 0.0037 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is t | |
CVE-2026-17529 |
low | 2.1 | 0.0037 | 2026-07-27 | A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function | |
CVE-2026-17530 |
low | 2.1 | 0.0037 | 2026-07-27 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerabil | |
CVE-2026-18773 |
low | 2.1 | 0.0035 | 2026-08-04 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is | |
CVE-2026-18992 |
low | 2.1 | 0.0037 | 2026-08-06 | A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the functi | |
CVE-2026-18997 |
low | 2.1 | 0.0037 | 2026-08-06 | A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the fun | |
CVE-2026-19006 |
low | 2.1 | 0.0037 | 2026-08-06 | A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file | |
CVE-2026-115361 |
low | 2.1 | 0.0021 | 2026-10-22 | OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops explicit deny rules ba | |
CVE-2026-115369 |
low | 2.1 | 0.0013 | 2026-10-22 | OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP | |
CVE-2026-116107 |
low | 2.1 | 0.0022 | 2026-10-26 | A vulnerability was detected in Datafeedr Product Sets Plugin up to 1.3.24 on WordPress. Affected by | |
CVE-2026-13508 |
low | 2.0 | 0.0029 | 2026-06-28 | A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the f | |
CVE-2026-115366 |
low | 2.0 | 0.0018 | 2026-10-22 | OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privile | |
CVE-2026-16122 |
low | 1.9 | 0.0031 | 2026-07-18 | A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulner | |
CVE-2022-41091 |
— | — | 0.0191 | — | Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting | KEV |
CVE-2023-21715 |
— | — | 0.1201 | — | Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, | KEV |
CVE-2023-20269 |
— | — | 0.2662 | — | Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulner | KEV |
CVE-2025-55177 |
— | — | 0.1351 | — | Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete autho | KEV |
CVE-2026-44573 |
— | — | 0.0080 | 2026-05-13 | Next.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 | |
CVE-2026-43999 |
— | — | 0.0097 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be byp | |
CVE-2026-50559 |
— | — | 0.0102 | 2026-06-19 | Quarkus is a Java framework for building cloud-native applications. Prior to versions 3.37.0, 3.36.3 | |
CVE-2026-43695 |
— | — | 0.0015 | 2026-09-14 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 a | |
CVE-2026-43737 |
— | — | 0.0015 | 2026-09-14 | An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7 and i | |
CVE-2026-43785 |
— | — | 0.0014 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iP |