Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2632)
CWE-79 (1807)
CWE-416 (1283)
CWE-862 (1172)
CWE-89 (1092)
CWE-22 (1018)
CWE-125 (869)
CWE-200 (844)
CWE-306 (834)
CWE-122 (828)
CWE-20 (791)
CWE-78 (703)
CWE-918 (686)
CWE-787 (681)
CWE-94 (637)
CWE-863 (613)
CWE-74 (600)
CWE-639 (535)
CWE-400 (516)
CWE-269 (501)
CWE-119 (494)
CWE-502 (467)
CWE-770 (435)
CWE-287 (427)
CWE-121 (404)
CWE-77 (372)
CWE-190 (365)
CWE-362 (321)
CWE-352 (274)
CWE-285 (242)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-62190 |
high | 8.7 | 0.0051 | 2026-07-13 | OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper | |
CVE-2026-63085 |
high | 8.7 | 0.0054 | 2026-07-16 | Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that | |
CVE-2026-62927 |
high | 8.7 | 0.0042 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, the Call service dispatches the original mixed batch t | |
CVE-2026-69118 |
high | 8.7 | 0.0080 | 2026-08-10 | Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template re | |
CVE-2026-74906 |
high | 8.7 | 0.0038 | 2026-08-18 | SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader- | |
CVE-2026-19198 |
high | 8.7 | 0.0030 | 2026-08-19 | Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkAc | |
CVE-2026-111352 |
high | 8.7 | 0.0046 | 2026-10-15 | ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController | |
CVE-2026-55103 |
high | 8.6 | 0.0020 | 2026-10-15 | Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0 | |
CVE-2026-118668 |
high | 8.6 | 0.0037 | 2026-10-28 | langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15. | |
CVE-2026-33031 |
high | 8.6 | 0.0027 | 2026-04-20 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was di | |
CVE-2026-57950 |
high | 8.6 | 0.0037 | 2026-06-29 | ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerabilit | |
CVE-2026-55638 |
high | 8.6 | 0.0658 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and / | |
CVE-2026-62187 |
high | 8.6 | 0.0037 | 2026-07-13 | OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun | |
CVE-2026-62188 |
high | 8.6 | 0.0037 | 2026-07-13 | OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerabi | |
CVE-2026-62231 |
high | 8.6 | 0.0028 | 2026-07-17 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key | |
CVE-2026-15829 |
high | 8.6 | 0.0020 | 2026-07-21 | A SQL injection (CWE-89) and security boundary bypass (CWE-863) vulnerability exists in the prebuilt | |
CVE-2026-48396 |
high | 8.6 | 0.0028 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code e | |
CVE-2026-68581 |
high | 8.6 | 0.0046 | 2026-08-02 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. B | |
CVE-2026-70463 |
high | 8.6 | 0.0036 | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth | |
CVE-2026-68791 |
high | 8.6 | 0.0054 | 2026-09-17 | Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose inform | |
CVE-2026-74035 |
high | 8.6 | 0.0050 | 2026-10-13 | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where securit | |
CVE-2026-74036 |
high | 8.6 | 0.0083 | 2026-10-13 | Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust | |
CVE-2026-95639 |
high | 8.6 | 0.0020 | 2026-10-13 | Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbit | |
CVE-2026-111231 |
high | 8.6 | 0.0084 | 2026-10-15 | Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-onl | |
CVE-2024-22031 |
high | 8.5 | 0.0043 | 2026-10-15 | A vulnerability has been identified within Rancher where a user with the ability to create a project | |
CVE-2026-39454 |
high | 8.5 | 0.0011 | 2026-04-20 | SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder | |
CVE-2026-54307 |
high | 8.5 | 0.0039 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member- | |
CVE-2026-26231 |
high | 8.5 | 0.0036 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to | |
CVE-2026-48113 |
high | 8.5 | 0.0039 | 2026-08-03 | Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, | |
CVE-2026-118669 |
high | 8.4 | 0.0031 | 2026-10-28 | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, th | |
CVE-2026-22682 |
high | 8.4 | 0.0013 | 2026-04-07 | OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in fi | |
CVE-2026-4857 |
high | 8.4 | 0.0027 | 2026-04-15 | IdentityIQ 8.5, all IdentityIQ 8.5 patch levels prior to 8.5p2, IdentityIQ 8.4, and all IdentityIQ 8 | |
CVE-2026-40599 |
high | 8.4 | 0.0013 | 2026-04-21 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. | |
CVE-2026-26289 |
high | 8.4 | 0.0014 | 2026-05-12 | PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with lim | |
CVE-2026-45108 |
high | 8.4 | 0.0025 | 2026-05-27 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to befor | |
CVE-2026-41048 |
high | 8.4 | 0.0018 | 2026-06-22 | Incorrect caching of authentication between different polkit methods in qSnapper before version 1.3. | |
CVE-2026-41049 |
high | 8.4 | 0.0018 | 2026-06-22 | Incorrect caching of authentication between different users of the qSnapper dbus service before ver | |
CVE-2026-54320 |
high | 8.4 | 0.0035 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-65049 |
high | 8.4 | 0.0044 | 2026-07-21 | Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorizat | |
CVE-2026-60723 |
high | 8.4 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market P | |
CVE-2026-70387 |
high | 8.4 | 0.0031 | 2026-10-21 | Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS o | |
CVE-2026-119115 |
high | 8.4 | — | 2026-10-29 | Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (a | |
CVE-2026-56835 |
high | 8.3 | 0.0022 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's S | |
CVE-2026-106077 |
high | 8.3 | 0.0023 | 2026-10-27 | A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read a | |
CVE-2026-28808 |
high | 8.3 | 0.0056 | 2026-04-07 | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to | |
CVE-2026-47866 |
high | 8.3 | 0.0038 | 2026-07-18 | VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the ne | |
CVE-2026-50528 |
high | 8.2 | 0.0061 | 2026-07-14 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a | |
CVE-2023-5009 |
high | 8.2 | 0.0965 | 2023-09-19 | An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, | |
CVE-2026-41432 |
high | 8.2 | 0.0085 | 2026-05-08 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys | |
CVE-2026-48390 |
high | 8.2 | 0.0025 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escala |