Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1848)
CWE-416 (1298)
CWE-862 (1184)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (643)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-57200 |
high | 7.5 | 0.0088 | 2026-10-27 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-118650 |
high | 7.5 | 0.0040 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance | |
CVE-2023-23918 |
high | 7.5 | 0.0202 | 2023-02-23 | A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that | |
CVE-2026-34376 |
high | 7.5 | 0.0038 | 2026-04-01 | PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multip | |
CVE-2026-32228 |
high | 7.5 | 0.0043 | 2026-04-18 | UI / API User with asset materialize permission could trigger dags they had no access to. Users are | |
CVE-2026-28873 |
high | 7.5 | 0.0031 | 2026-05-11 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9 and i | |
CVE-2026-34645 |
high | 7.5 | 0.0056 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-34646 |
high | 7.5 | 0.0041 | 2026-05-12 | Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier | |
CVE-2026-48860 |
high | 7.5 | 0.0021 | 2026-06-10 | Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) all | |
CVE-2026-56842 |
high | 7.5 | 0.0036 | 2026-07-02 | A malicious actor with access to the network and under certain conditions could exploit an Incorrect | |
CVE-2026-40452 |
high | 7.5 | 0.0043 | 2026-07-10 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass | |
CVE-2026-43977 |
high | 7.5 | 0.0029 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated | |
CVE-2026-60320 |
high | 7.5 | 0.0041 | 2026-07-21 | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset | |
CVE-2026-54719 |
high | 7.5 | 0.0035 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, th | |
CVE-2026-71234 |
high | 7.5 | 0.0039 | 2026-08-05 | Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, re | |
CVE-2026-114476 |
high | 7.5 | 0.0027 | 2026-10-21 | Incorrect authorization in the REST administration API of Progressive Robot hMailServer 6.3.4 throug | |
CVE-2026-115365 |
high | 7.5 | 0.0030 | 2026-10-22 | OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy | |
CVE-2026-86977 |
high | 7.5 | 0.0014 | 2026-10-20 | An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS | |
CVE-2026-40213 |
high | 7.4 | 0.0021 | 2026-05-07 | OpenStack Cyborg before 16.0.1 uses rule:allow (check_str='@') as the default policy for multiple AP | |
CVE-2026-9127 |
high | 7.3 | 0.0015 | 2026-07-14 | A remote code execution security issue exists within Studio 5000 Logix Designer® due to incorrect au | |
CVE-2026-9640 |
high | 7.2 | 0.0063 | 2026-06-26 | A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5. | |
CVE-2026-58056 |
high | 7.2 | 0.0033 | 2026-06-28 | RustDesk gates incoming control messages on per-capability flags rather than on the session's author | |
CVE-2026-62186 |
high | 7.2 | 0.0033 | 2026-07-13 | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible | |
CVE-2026-62192 |
high | 7.2 | 0.0042 | 2026-07-13 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord | |
CVE-2026-59258 |
high | 7.2 | 0.0046 | 2026-07-15 | immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:user | |
CVE-2026-65015 |
high | 7.2 | 0.0061 | 2026-07-22 | n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature whe | |
CVE-2026-13067 |
high | 7.2 | 0.0010 | 2026-07-22 | When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certi | |
CVE-2026-18255 |
high | 7.2 | 0.0077 | 2026-07-29 | A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot acc | |
CVE-2026-18635 |
high | 7.2 | 0.0046 | 2026-08-11 | Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user | |
CVE-2026-18690 |
high | 7.2 | 0.0041 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with a limited database-scoped role to | |
CVE-2026-85166 |
high | 7.2 | 0.0036 | 2026-09-03 | n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline wor | |
CVE-2026-41325 |
high | 7.1 | 0.0036 | 2026-04-24 | Kirby is an open-source content management system. Kirby's user permissions control which user role | |
CVE-2026-41427 |
high | 7.1 | 0.0021 | 2026-04-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.5, the clien | |
CVE-2026-32991 |
high | 7.1 | 0.0023 | 2026-05-13 | Improper authorization checks of team members privileges allow a team member to escalate privileges | |
CVE-2026-42280 |
high | 7.1 | 0.0021 | 2026-05-27 | Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific precon | |
CVE-2026-44473 |
high | 7.1 | 0.0017 | 2026-05-27 | Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup | |
CVE-2026-47195 |
high | 7.1 | 0.0027 | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands chec | |
CVE-2026-47120 |
high | 7.1 | 0.0031 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-34023 |
high | 7.1 | 0.0034 | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authori | |
CVE-2026-48089 |
high | 7.1 | 0.0036 | 2026-06-19 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a | |
CVE-2026-57951 |
high | 7.1 | 0.0043 | 2026-06-29 | Mythic before 3.4.0.60 contains a broken hasura permission filter on the payload_build_step table wi | |
CVE-2026-53902 |
high | 7.1 | 0.0034 | 2026-07-01 | MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-secti | |
CVE-2026-28740 |
high | 7.1 | 0.0032 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj | |
CVE-2026-56220 |
high | 7.1 | 0.0024 | 2026-07-08 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT p | |
CVE-2026-35210 |
high | 7.1 | 0.0035 | 2026-07-08 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | |
CVE-2026-39903 |
high | 7.1 | 0.0047 | 2026-07-10 | Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an author | |
CVE-2026-55460 |
high | 7.1 | 0.0044 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w | |
CVE-2026-62191 |
high | 7.1 | 0.0036 | 2026-07-13 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message | |
CVE-2026-15641 |
high | 7.1 | 0.0029 | 2026-07-14 | Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1 | |
CVE-2026-47732 |
high | 7.1 | 0.0040 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP s |