Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-70452 |
critical | 9.1 | 0.0046 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attacker | |
CVE-2026-95695 |
critical | 9.1 | 0.0032 | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker | |
CVE-2026-87095 |
critical | 9.1 | 0.0024 | 2026-10-21 | Sensitive information disclosure and manipulation due to improper authorization checks. The followin | |
CVE-2026-97406 |
critical | 9.1 | 0.0022 | 2026-10-20 | XERJ Console API bearer tokens can bypass the passkey‑only authentication requirement and directly i | |
CVE-2026-44221 |
critical | 9.0 | 0.0034 | 2026-05-12 | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, authenticat | |
CVE-2026-112380 |
critical | 9.0 | 0.0041 | 2026-10-20 | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a | |
CVE-2026-58424 |
high | 8.9 | 0.0025 | 2026-07-03 | Permanent Fork PR Workflow Approval Gate Bypass | |
CVE-2026-43945 |
high | 8.9 | 0.0084 | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3. | |
CVE-2026-43947 |
high | 8.9 | 0.0091 | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unaut | |
CVE-2026-47303 |
high | 8.8 | 0.0084 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to ele | |
CVE-2026-105733 |
high | 8.8 | 0.0033 | 2026-10-13 | Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. | |
CVE-2026-70299 |
high | 8.8 | 0.0034 | 2026-10-13 | Improper access control in Windows Bind Filter Driver allows an authorized attacker to elevate privi | |
CVE-2026-97380 |
high | 8.8 | 0.0128 | 2026-10-16 | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1 | |
CVE-2026-62872 |
high | 8.8 | 0.0078 | 2026-08-11 | Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a | |
CVE-2026-70246 |
high | 8.8 | 0.0086 | 2026-10-13 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate priv | |
CVE-2026-102862 |
high | 8.8 | 0.0079 | 2026-10-13 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate priv | |
CVE-2026-77910 |
high | 8.8 | 0.0087 | 2026-10-13 | Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privil | |
CVE-2026-40350 |
high | 8.8 | 0.0044 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, | |
CVE-2026-5712 |
high | 8.8 | 0.0016 | 2026-04-29 | This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is t | |
CVE-2026-42843 |
high | 8.8 | 0.0035 | 2026-05-11 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont | |
CVE-2026-2465 |
high | 8.8 | 0.0023 | 2026-05-12 | Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet | |
CVE-2026-42998 |
high | 8.8 | 0.0030 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential aut | |
CVE-2026-42999 |
high | 8.8 | 0.0033 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in en | |
CVE-2026-43000 |
high | 8.8 | 0.0033 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application crede | |
CVE-2026-46519 |
high | 8.8 | 0.0051 | 2026-06-11 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Prior to | |
CVE-2026-45831 |
high | 8.8 | 0.0024 | 2026-06-12 | The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaD | |
CVE-2026-54998 |
high | 8.8 | 0.0078 | 2026-07-02 | Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privil | |
CVE-2026-27775 |
high | 8.8 | 0.0091 | 2026-07-03 | Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receiv | |
CVE-2026-14536 |
high | 8.8 | 0.0043 | 2026-07-06 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2. | |
CVE-2026-56086 |
high | 8.8 | 0.0042 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through | |
CVE-2026-8800 |
high | 8.8 | 0.0037 | 2026-07-08 | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Audit User module). This issue a | |
CVE-2026-15125 |
high | 8.8 | 0.0040 | 2026-07-08 | Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote atta | |
CVE-2026-55242 |
high | 8.8 | 0.0020 | 2026-07-15 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, | |
CVE-2026-10130 |
high | 8.8 | 0.0056 | 2026-07-18 | QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to | |
CVE-2026-17568 |
high | 8.8 | 0.0042 | 2026-07-27 | Improper access control in the role membership management endpoint in Devolutions Server allows an a | |
CVE-2026-42016 |
high | 8.8 | 0.0864 | 2026-07-27 | JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escala | KEV |
CVE-2026-7868 |
high | 8.8 | 0.0037 | 2026-07-28 | IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to es | |
CVE-2026-49473 |
high | 8.8 | 0.0047 | 2026-08-13 | @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Ce | |
CVE-2026-61574 |
high | 8.8 | 0.0062 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Con | |
CVE-2026-48508 |
high | 8.8 | 0.0033 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPer | |
CVE-2026-68561 |
high | 8.8 | 0.0051 | 2026-08-19 | Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) ru | |
CVE-2026-56832 |
high | 8.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots | |
CVE-2026-57117 |
high | 8.8 | 0.0040 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedA | |
CVE-2026-35029 |
high | 8.7 | 0.3861 | 2026-04-06 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83. | |
CVE-2026-40515 |
high | 8.7 | 0.0023 | 2026-04-17 | OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers t | |
CVE-2026-46366 |
high | 8.7 | 0.0034 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an information disclosure vulnerability in the getIdFromSolutionId() | |
CVE-2026-42096 |
high | 8.7 | 0.0060 | 2026-05-19 | Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database | |
CVE-2026-54281 |
high | 8.7 | 0.0050 | 2026-06-22 | Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.24, an aut | |
CVE-2026-56232 |
high | 8.7 | 0.0034 | 2026-06-24 | Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys pr | |
CVE-2026-8079 |
high | 8.7 | 0.0032 | 2026-07-02 | In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenti |