Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2633)
CWE-79 (1817)
CWE-416 (1289)
CWE-862 (1174)
CWE-89 (1095)
CWE-22 (1022)
CWE-125 (878)
CWE-200 (846)
CWE-306 (837)
CWE-122 (829)
CWE-20 (793)
CWE-78 (708)
CWE-918 (688)
CWE-787 (681)
CWE-94 (639)
CWE-863 (617)
CWE-74 (600)
CWE-639 (538)
CWE-400 (521)
CWE-269 (501)
CWE-119 (494)
CWE-502 (468)
CWE-770 (438)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (366)
CWE-362 (322)
CWE-352 (275)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-48390 |
high | 8.2 | 0.0025 | 2026-07-28 | Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escala | |
CVE-2026-19550 |
high | 8.2 | 0.0046 | 2026-08-11 | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on t | |
CVE-2026-41424 |
high | 8.2 | 0.0047 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-70229 |
high | 8.1 | 0.0104 | 2026-10-13 | Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execu | |
CVE-2026-61726 |
high | 8.1 | 0.0029 | 2026-10-16 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. | |
CVE-2026-39331 |
high | 8.1 | 0.0021 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can | |
CVE-2026-23902 |
high | 8.1 | 0.0045 | 2026-04-24 | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with sys | |
CVE-2026-43913 |
high | 8.1 | 0.0027 | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an | |
CVE-2026-44260 |
high | 8.1 | 0.0035 | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFi | |
CVE-2026-48064 |
high | 8.1 | 0.0034 | 2026-05-27 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.1, w | |
CVE-2026-44394 |
high | 8.1 | 0.0025 | 2026-05-28 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping | |
CVE-2026-28699 |
high | 8.1 | 0.0055 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed | |
CVE-2026-28744 |
high | 8.1 | 0.0043 | 2026-07-03 | Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer to | |
CVE-2026-54652 |
high | 8.1 | 0.0029 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} end | |
CVE-2026-60951 |
high | 8.1 | 0.0036 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal O | |
CVE-2026-14537 |
high | 8.1 | 0.0025 | 2026-07-31 | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versio | |
CVE-2026-113874 |
high | 8.1 | 0.0032 | 2026-10-22 | SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously establ | |
CVE-2026-94262 |
high | 8.1 | 0.0029 | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extend | |
CVE-2026-43001 |
high | 8.0 | 0.0047 | 2026-05-01 | An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate t | |
CVE-2026-83792 |
high | 7.8 | 0.0032 | 2026-10-13 | Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate p | |
CVE-2026-61925 |
high | 7.8 | 0.0030 | 2026-08-11 | Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges loc | |
CVE-2026-69278 |
high | 7.8 | 0.0032 | 2026-08-11 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security f | |
CVE-2026-96918 |
high | 7.8 | 0.0032 | 2026-10-13 | Improper access control in Windows NTFS allows an authorized attacker to elevate privileges locally. | |
CVE-2026-28951 |
high | 7.8 | 0.0013 | 2026-05-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7 | |
CVE-2026-96512 |
high | 7.8 | 0.0032 | 2026-09-23 | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restriction | 2 PoC |
CVE-2026-54555 |
high | 7.8 | 0.0020 | 2026-06-23 | rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the | |
CVE-2026-60625 |
high | 7.8 | 0.0016 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). | |
CVE-2026-114490 |
high | 7.8 | 0.0011 | 2026-10-21 | Incorrect authorization in the COM administration API of Progressive Robot hMailServer 6.3.4 through | |
CVE-2026-56838 |
high | 7.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI rec | |
CVE-2026-57142 |
high | 7.8 | 0.0015 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI rec | |
CVE-2026-44252 |
high | 7.7 | 0.0054 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-114059 |
high | 7.7 | 0.0064 | 2026-10-21 | ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated use | |
CVE-2026-100105 |
high | 7.7 | 0.0029 | 2026-10-28 | A user with permission to edit contact points but not their protected fields can change protected se | |
CVE-2026-46717 |
high | 7.7 | 0.0034 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-61644 |
high | 7.7 | 0.0031 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api | |
CVE-2026-62202 |
high | 7.7 | 0.0054 | 2026-07-17 | OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated | |
CVE-2026-62217 |
high | 7.7 | 0.0045 | 2026-07-17 | OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals | |
CVE-2026-62223 |
high | 7.7 | 0.0045 | 2026-07-17 | OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval | |
CVE-2026-62228 |
high | 7.7 | 0.0045 | 2026-07-17 | OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that a | |
CVE-2026-43946 |
high | 7.7 | 0.0057 | 2026-07-21 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an autho | |
CVE-2026-62354 |
high | 7.7 | 0.0045 | 2026-08-03 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10. | |
CVE-2026-48447 |
high | 7.7 | 0.0022 | 2026-08-11 | Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbit | |
CVE-2026-105942 |
high | 7.7 | 0.0048 | 2026-10-21 | When a configured proxy role sends a request to the broker on behalf of another user (the original p | |
CVE-2026-111044 |
high | 7.6 | 0.0016 | 2026-10-16 | Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525 | |
CVE-2026-42349 |
high | 7.6 | 0.0025 | 2026-05-11 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. has(), auth.protect | |
CVE-2026-45226 |
high | 7.6 | 0.0029 | 2026-05-12 | Heym before 0.0.21 contains an authorization bypass vulnerability in workflow execution that allows | |
CVE-2026-53855 |
high | 7.6 | 0.0026 | 2026-06-16 | OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operato | |
CVE-2026-61325 |
high | 7.6 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Interna | |
CVE-2026-70474 |
high | 7.6 | 0.0048 | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. | |
CVE-2026-104189 |
high | 7.5 | 0.0035 | 2026-10-27 | The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that suppor |